On Tue, 2008-09-23 at 23:21 +1000, James Morris wrote: > On Mon, 22 Sep 2008, Stephen Smalley wrote: > > > Patch below for the recent /proc/net bug related to selinux thread on linux-kernel. > > If this looks sane, then possibly it should be re-sent on that thread. > > > > As we are not concerned with fine-grained control over reading of > > symlinks in proc, always use the default proc SID for all proc symlinks. > > This should help avoid permission issues upon changes to the proc tree > > as in the /proc/net -> /proc/self/net example. > > This does not alter labeling of symlinks within /proc/pid directories. > > ls -Zd /proc/net output before and after the patch should show the difference. > > I'm not seeing any difference. Before the patch: $ ls -Zd /proc/net lrwxrwxrwx root root system_u:object_r:proc_net_t:s0 /proc/net -> self/net (/proc/net symlink has proc_net_t type due to matching net in genfs_contexts, and as legacy policy didn't expect any symbolic links to have proc_net_t, applications are denied access to read the symlink) After the patch: $ ls -Zd /proc/net lrwxrwxrwx root root system_u:object_r:proc_t:s0 /proc/net -> self/net (/proc/net symlink has proc_t type due to always using default proc sid, and as legacy policy already allows domains to read proc_t:lnk_file to follow /proc/self, applications previously allowed to access /proc/net before it was changed to a symlink will just work) -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
