-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Christopher J. PeBenito wrote: | On Fri, 2008-05-23 at 10:34 -0400, Daniel J Walsh wrote: |> Mainly adding additional dontaudits for permissive domains. | |> Subject: [PATCH] refpolicy: kernel_kernel changes |> --text follows this line-- |> --- nsaserefpolicy/policy/modules/kernel/kernel.if 2008-05-23 09:15:06.224337000 -0400 |> +++ serefpolicy-3.4.1/policy/modules/kernel/kernel.if 2008-05-23 10:29:05.107838000 -0400 |> @@ -1198,6 +1198,7 @@ |> ') |> |> dontaudit $1 proc_type:dir list_dir_perms; |> + dontaudit $1 proc_type:file getattr; |> ') |> |> ######################################## |> @@ -1768,6 +1769,7 @@ |> ') |> |> dontaudit $1 sysctl_type:dir list_dir_perms; |> + dontaudit $1 sysctl_type:file read_file_perms; |> ') |> |> ######################################## | | These two violate the intention of the interface. | I though the intention of the interface was to dontaudit list of all proc or sysctl. I believe this means we know this app tries to list sysctl or proc so dontaudit the listing. Well part of the listing in permissive mode is the getattr or read. So to make this work the way customers would expect we need to add interfaces all over the place and patch every call to this will a dontaudit file, which seems to be a colossal waste of time. Maybe we need a way to indicate whether this should be dontaudited in enforcing mode versus permissive. Added patch for cgroup_t. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkhQBckACgkQrlYvE4MpobM7GwCfTcHGsZQV8ZRuKTD9I6/YJ2e4 snkAoM+HSsJzbfDEfAvXfxb0ZeXbZWo/ =j1e0 -----END PGP SIGNATURE-----
--- nsaserefpolicy/policy/modules/kernel/kernel.te 2008-06-11 08:15:43.000000000 -0400 +++ serefpolicy-3.4.1/policy/modules/kernel/kernel.te 2008-06-11 10:06:56.000000000 -0400 @@ -45,6 +45,15 @@ sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh) # +# cgroup fs +# + +type cgroup_t; +fs_type(cgroup_t) +allow cgroup_t self:filesystem associate; +genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0) + +# # DebugFS # +
Attachment:
kernel_kernel.patch.sig
Description: PGP signature
