Re: Single home directory type for all roles.

[Russell Coker <rcoker@redhat.com>]

On Thu, 2004-12-09 at 20:07 +0100, Thomas Bleher wrote:
> A while ago we had this discussion on the lsm-list. Colin suggested
> using the following patch to prevent symlinks attacks:
> 
> --- orig/constraints
> +++ mod/constraints
> @@ -67,3 +67,7 @@
>  constrain socket_class_set { create relabelto relabelfrom } 
>  	( u1 == u2 or t1 == privowner );
>  
> +# read symlinks under /tmp only if owners match
> +constrain lnk_file read
> +	( t2 != tmpfile or u1 == u2 );
> + 

That will be fine AFTER we have a follow operation as in the sample
patch Steve just posted.

For some particular environments with clueful administrators it might
not be a big deal to deny the administrator the ability to run
"ls -l /tmp" and see everything that they would see without SE Linux.
In most cases I believe that they will demand that they can have a fully
functional ls.  Also even for skilled administrators, it's just really
handy to be able to see what the users are doing.  Being forced to login
as a user (or su to the user in Fedora) just to see what sym-links they
have in /tmp is unweildy.

Also the constraints entry would have to apply to home_type for correct
operation on systems where /tmp and /home are on the same file system
which is the result of "autopartitioning" in Fedora Core and a common
practice by many (most?) administrators of small systems.

constrain lnk_file read
	( (t2 != tmpfile and t2 != home_type) or u1 == u2 );

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.