On Tue, Jul 21, 2020 at 12:56 PM Richard Haines <richard_c_haines@xxxxxxxxxxxxxx> wrote: > > On Tue, 2020-07-21 at 12:42 -0400, Paul Moore wrote: > > On Sun, Jul 19, 2020 at 2:17 PM Dominick Grift > > <dominick.grift@xxxxxxxxxxx> wrote: > > > This example CIL policy takes a different approach: > > > > > > 1. Leverages CIL > > > 2. Installs using semodule to make it tunable at runtime (but you > > > can obviously also use secilc to build a monolithic version and > > > deploy that) > > > 3. Makes few assumptions about variables > > > 4. Leverages handleunknown allow and declares least required access > > > vectors so that you can pick and choose which access vectors you > > > want to use and ignore the remainder > > > 5. Leverages unlabeled and file ISID and makes no assumptions about > > > any volatile filesystems you may or may not use > > > 6. As small and simple as reasonably possible, heavily documented > > > 7. Modern, Requires SELinux 3.1 > > > > > > Signed-off-by: Dominick Grift <dominick.grift@xxxxxxxxxxx> > > > --- > > > v2: rename XWAYLAND.md to XSERVER_XWAYLAND.md and cover both > > > Xserver as well as Xwayland > > > V3: fix typo in XSERVER_XWAYLAND.md and exclude x_contexts > > > altogether > > > v4: remove XSERVER_XWAYLAND and add the note to README.md, redo > > > README.md and clean up cil-policy.cil > > > v5: add -F to fixfiles onboot (onboot should probably just imply > > > -F) > > > > > > src/cil_overview.md | 11 + > > > src/notebook-examples/README.md | 2 + > > > src/notebook-examples/cil-policy/Makefile | 31 ++ > > > src/notebook-examples/cil-policy/README.md | 90 ++++ > > > .../cil-policy/cil-policy.cil | 448 > > > ++++++++++++++++++ > > > 5 files changed, 582 insertions(+) > > > create mode 100644 src/notebook-examples/cil-policy/Makefile > > > create mode 100644 src/notebook-examples/cil-policy/README.md > > > create mode 100644 src/notebook-examples/cil-policy/cil-policy.cil > > > > James, Richard, you both had comments on previous drafts, does v3 > > look > > good to you guys? > > Yes I've tested this (v4 & V5) a few times and okay on Fedora 32 WS. > > Acked-by: Richard Haines <richard_c_haines@xxxxxxxxxxxxxx> Looks good. Acked-by: James Carter <jwcart2@xxxxxxxxx> > > > > > > -- > > paul moore > > www.paul-moore.com >
