On Mon, 2011-08-08 at 17:32 +0800, Rongqing Li wrote: > On 08/05/2011 09:56 PM, Stephen Smalley wrote: > > I'm not sure it is a good idea to output nothing if permission is denied > > to the socket, as opposed to some well-defined string indicating that > > condition. Particularly if someone later adds another field to > > the /proc files after the context; we don't want the contents of that > > field to be interpreted as the context if permission was denied. > > > > From your review, I redesign the output information as below. > > when disable SELinux, print "(none)" in proc > when enable SELinux, no error on getting security context, print the > real security context > when enable SELinux, there is error on getting security context, print > "??" > > Do you think it is OK? It appears that netstat presently displays a "-" if it cannot obtain the security context or pid/program name information, so perhaps you should follow that convention whenever you cannot obtain a security context regardless of the particular reason. Note that your logic shouldn't be based on whether or not SELinux is enabled/disabled per se, but rather based on whether the security module provides security contexts, which can be determined by checking whether the secid is set to a non-zero value by security_sk_getsecid(). The audit system (kernel/audit*.c) uses similar logic to decide whether or not to log task security contexts. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
