Re: [RFC][PATCH] selinux: introduce support for deferred mapping of inode security contexts

[Jeremy Katz <katzj@redhat.com>]

On Thu, 2006-05-25 at 11:28 -0400, Stephen Smalley wrote:
> On Thu, 2006-05-25 at 11:19 -0400, Stephen Smalley wrote:
> > The alternative model to post checking after policy load would be to
> > either:
> > 1) Precheck the file contexts from the header against the .pp file in
> > some manner at install time (in which case rpm can abort early), or
> 
> And as I suspect that you'll say that since those contexts were
> generated from the .pp file in the first place, no such checking is
> required, let me note that:
> a) the contexts will have been generated from the file contexts part of
> the .pp, not from the policy module itself, so there could be an
> inconsistency between the two that leaves the context invalid under the
> new policy, and

I still think that it's somewhat important to try to ensure that this
doesn't happen before you get to installing the package, just because at
that point, you're basically putting the user in the "you're hosed, do
not pass go, do not collect $200" position.  So I still hope that we
don't end up with this being a common occurrence :-)

> b) having rpm recheck at install time provides us with both greater
> robustness (in the event of a bug in rpmbuild or a package corrupted in
> some manner along the way) and security (in the event of a maliciously
> constructed package).

But I'm willing to concede that adding some form of checking here may
well make sense.  But I'm not convinced it will necessarily belong in
rpm itself -- it may make more sense to have it in the
policy_module_loader_helper which is going to end up being needed to
avoid stupid scriptlet errors.  But that's in the realm of it not really
mattering who's checking in that it's being checked.  Does that seem
reasonable?

Jeremy


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.