concept of a permissive domain

[Eric Paris <eparis@redhat.com>]

So there was a brief conversation between dan, karl, and myself today
about implementing a permissive subject domain.  Basically there would
be some new language construct possibly "permissive httpd_t true;" which
would then set a flag.  If this flag was set, all denials would be
logged but the operation would be permitted.  This would make it
possible to create a type_exec_t and type_t for your new domain, mark it
as permissive/unconfined and run it as long as you like.  Once you get
all your new allow rules you just remove the permissive bit.  You didn't
have to setenforce the whole system.

First thought from Karl was to use the 'char primary' field of the
struct type_datum.  Seems reasonable enough, after we have that
information in kernel it shouldn't take me too much playing around in
avc_has_perm_noaudit to check if this flag is set on a denial.  I don't
think slowing down the denial path a little by having to call back in to
see if this flag was set for a given source sid is that big of deal.
Maybe I could keep it just about as fast by adding more flags
audit_allow_once (can't really reuse audit_allow) to the avd or
something like that, but it seems like a large waste of space to carry
another set of audit flags that won't be used much.

Thoughts?  Other ways to implement this?  Problems with the basic premis
of an unconfined domain?

-Eric


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.