Re: file context ordering

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Fri, 2005-07-29 at 06:26 -0400, Daniel J Walsh wrote:
> Christopher J. PeBenito wrote:
> >One of the problems we've come against with reference policy (also in
> >loadable modules) is the fact that the file context specifications are
> >not ordered correctly, since the system file_contexts are taken from the
> >modules and concatenated in an arbitrary order.  The matchpathcon code
> >finds a match by going through all of the specs, and the last one that
> >is matched is used.
[cut]
> >This still does not end up being perfect, since we have specs that are
> >of about the same specificity, and end up being in a different order
> >then the current fc.  For example, these two specs end up being in the
> >opposite order that they are in the NSA example policy:
> >
> >/usr(/.*)?/bin(/.*)?        system_u:object_r:bin_t
> >/usr(/.*)?/lib(64)?(/.*)?   system_u:object_r:lib_t
> >
> >  
> >
> We could add on a case by case basis
> 
> /usr(/.*)?/lib(64)?(/.*)?/bin(/.*)?   system_u:object_r:bin_t

This would be a good solution for now.  I still feel that, if possible,
we should find a generic solution.

> Or hard code some hierarchy where bin_t is always after lib_t in this
> situation.
> 
> I would doubt we would have /usr/bin/lib/...

Well hard coding it isn't the answer, especially since this is just one
example.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.