On Thu, May 7, 2020 at 4:26 AM Ondrej Mosnacek <omosnace@xxxxxxxxxx> wrote:
>
> On Wed, May 6, 2020 at 11:14 PM Stephen Smalley
> <stephen.smalley.work@xxxxxxxxx> wrote:
> [...]
> > ---
> > v2 improves the patch description and README.md and tries to provide
> > greater compatibility with older systems. NB One must set SUPPORTS_CIL
> > to n to disable loading the CIL modules; the alternative would be
> > some kind of package version test but doing so in a distro-agnostic
> > and backward-compatible manner looks painful.
>
> Thanks! As I said in another reply, I agree that CIL support detection
> wouldn't be worth it here.
I just remembered that we do have the os_detect and
ifeq(x$(DISTRO),... support in the Makefiles,
so I could set SUPPORTS_CIL automatically to n in the RHEL6 case that way.
> > diff --git a/policy/test_execute_no_trans.te b/policy/test_execute_no_trans.te
> > index 79ba868..2c0346a 100644
> > --- a/policy/test_execute_no_trans.te
> > +++ b/policy/test_execute_no_trans.te
> > @@ -24,4 +24,5 @@ userdom_sysadm_entry_spec_domtrans_to(test_execute_notrans_t)
> >
> > #Allow test_execute_notrans permissions to the allowed type
> > can_exec(test_execute_notrans_t,test_execute_notrans_allowed_t)
> > -allow test_execute_notrans_t test_execute_notrans_denied_t:file mmap_file_perms;
> > +allow_map(test_execute_notrans_t, test_execute_notrans_denied_t, file)
> > +allow test_execute_notrans_t test_execute_notrans_denied_t:file { getattr open read };
>
> An alternative solution could be to use "mmap_file_perms" unless it is
> not defined, in which case we can assume a non-legacy policy and use
> the proper "mmap_exec_file_perms". But I'm fine with your approach as
> well if you don't want to change it.
This seems a little safer to me given the confusion about what
mmap_exec_file_perms contains but either way.
