Eric Paris wrote:
On Tue, Dec 30, 2008 at 1:13 PM, David P. Quigley <dpquigl@xxxxxxxxxxxxx> wrote:
So commit bb26c6c29b7cc9f39e491b074b09f3c284738d36 is a merger of James'
security tree into Linus's main tree. On of the patch sets in there is
the new credentials work from David Howells. One of those patches adds a
kernel service object class to selinux so policy can be written to all
that service to be granted the ability to override certain permission
checks. I just built a policy from refpolicy and the policy.conf doesn't
have a kernel_service object class. I'm not sure if the policy engine
uses the kernel headers, the dynamic object class discovery mechanism,
or a built in list to generate the boilerplate with all the object
classes and permissions. Regardless it is mainly so things like cachefs
and NFSD can be granted the ability to act as other entities when
making/fulfilling requests. I don't think there is a need to be
concerned about it yet unless something is no longer working for you.
It shouldn't be of concern to you. But refpolicy needs to add at
least the class (if not the perms) so it doesn't get assigned to
anything else...
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=1bfdc75ae077d60a01572a7781ec6264d55ab1b9
Looks like it is class number 74 (and if it's already used in policy
we need to fix one or the other quickly....)
No worries man!!
regards;
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
