On Tue, Aug 23, 2016 at 9:05 AM, Stephen Smalley <sds@xxxxxxxxxxxxx> wrote: > On 08/22/2016 06:36 PM, Paul Moore wrote: >> On Mon, Aug 22, 2016 at 5:04 PM, Guido Trentalancia >> <guido@xxxxxxxxxxxxxxxx> wrote: >>> Modify the SELinux kernel code so that it is able to classify sockets with >>> the new AF_ALG namespace (used for the user-space interface to the kernel >>> Crypto API). >>> >>> A companion patch has been created for the Reference Policy and it will be >>> posted to its mailing list, once this patch is merged. >>> >>> Signed-off-by: Guido Trentalancia <guido@xxxxxxxxxxxxxxxx> >>> --- >>> security/selinux/hooks.c | 5 +++++ >>> security/selinux/include/classmap.h | 2 ++ >>> security/selinux/include/security.h | 2 ++ >>> security/selinux/ss/services.c | 3 +++ >>> 4 files changed, 12 insertions(+) >> >> You are still missing the policy capability code for >> security/selinux/selinuxfs.c. I think it would also be a good idea to >> write a test for this and add it to the selinux-testsuite; not only >> will this help us confirm this code works as expected, but it will >> demonstrate what the new policy would look like and help establish a >> regression test for future use. >> >> * https://github.com/SELinuxProject/selinux-testsuite > > I also think that if we are going to go to the trouble of adding a new > policy capability for this (versus just relying on > handle_unknown=allow), then we ought to identify and define all socket > classes that we think we might want. Otherwise we'll end up with 50 > different policy capabilities, one for each new socket class. To be clear, we can't rely only on the new/unknown object class handling for this particular case since this change would convert some of the existing generic socket access checks to the algsocket access checks which could result in undesired access for policies which set handle_unknown=allow. The new/unknown object class handling works well for new access controls, but sometimes has problems with modified access controls. As far as additional socket classes are concerned, it does some reasonable to add more than just AF_ALG in an effort to try and consolidate things. Guido, is this something you would be willing to work on? -- paul moore www.paul-moore.com _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
