Shell redirection and denials

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

One of Dan's constant sources of avcs is something like:

/usr/sbin/my_confined_app > some_file

Because the file is created by the shell, opened, and the FD handed to
the application avcs can occur on read and write.

Getting rid of these via policy is next to impossible - the destination
file type is usually governed by the directory and we don't actually
want to allow that access directly to the confined application. I'd like
to see if there is some other way to get rid of these denials.

I see two possible solutions:

1) Make the shell create and pass a descriptor to a pipe to the
application - the shell itself would read / write to the file. This
seems, to me, to more accurately reflect how we want to enforce the
permissions.

2) Allow applications to confer access by passing the file descriptor
(more like capabilities). This more closely matches how Unix actually
works and, of course, is a huge source of vulnerabilities. Allowing this
type of scheme just for shells might not be that bad.

Has either of these been investigated? 1 seems pretty simple - is there
something I'm missing here (perhaps the redirection should outlast the
shell lifetime?).

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.