From: Dominick Grift <dominick.grift@gmail.com>
To: James Carter <jwcart2@tycho.nsa.gov>
Cc: SELinux List <selinux@tycho.nsa.gov>,
Steve Lawrence <slawrence@tresys.com>,
Richard Haines <richard_c_haines@btinternet.com>
Subject: Re: Update to CIL
Date: Thu, 24 Oct 2013 22:16:36 +0200 [thread overview]
Message-ID: <1382645796.3041.159.camel@d30> (raw)
In-Reply-To: <52617C02.4060500@tycho.nsa.gov>
On Fri, 2013-10-18 at 14:20 -0400, James Carter wrote:
> I pushed an update of CIL to bitbucket.
Now that we can specify contraints in "loadable modules" i noticed that
i can alter the behavior of existing constraints in the sense that they
can be overridden
take for example this instance
in the domain module ( which i consider "base" ) i have this constraint:
> (constrain (process (transition dyntransition noatsecure siginh rlimitinh))
> (or (or (or (eq u1 u2) (and (eq t1
> can_change_process_identity) (eq t2 process_user_target)))
> (and (eq t1 can_system_change) (eq u2 system_u)))
> (eq t1 process_uncond_exempt)))
>
This seems to work fine. however if i now want to extent this from a loadable
module. for example the cron module:
> (constrain (process (transition dyntransition noatsecure siginh rlimitinh))
> (or (eq u1 u2) (and (eq t1 cron_source_domain) (or
> (eq t2 cron_job_domain) (eq u2 system_u)))))
Then the former "base" constraint no longer works. Its not getting extended
but rather a new one gets added and now the first one fails because the second on
is not met
it would have been nice if cilc merged the two into a single constraint instead
In practice its not a big deal because the source policy is probably on the system
anyways so might as well put it in the domain module
But it would have been nice if i could put it in the module where it belongs so that when
i choose to disable the module, the module related constraint rules disappear as well
Is this a right assumption or are my constraints just wrong?
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2013-10-24 20:16 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-18 18:20 Update to CIL James Carter
2013-10-18 20:02 ` Dominick Grift
2013-10-19 13:32 ` Dominick Grift
2013-10-19 18:03 ` Dominick Grift
2013-10-20 14:25 ` Dominick Grift
2013-10-21 13:25 ` Steve Lawrence
2013-10-21 18:56 ` James Carter
2013-10-21 12:35 ` Steve Lawrence
2013-10-19 16:23 ` Richard Haines
2013-10-21 13:36 ` Steve Lawrence
2013-10-21 14:22 ` Richard Haines
2013-10-21 14:46 ` Steve Lawrence
2013-10-21 15:49 ` Request for a new CIL statement Richard Haines
2013-10-21 19:14 ` Update to CIL James Carter
2013-10-23 13:59 ` Dominick Grift
2013-10-23 14:29 ` James Carter
2013-10-23 15:15 ` Dominick Grift
2013-10-23 15:58 ` James Carter
2013-10-23 17:00 ` James Carter
2013-10-23 17:27 ` Dominick Grift
2013-10-24 20:16 ` Dominick Grift [this message]
2013-10-25 17:53 ` Dominick Grift
2013-10-25 18:40 ` James Carter
2013-10-25 18:55 ` Dominick Grift
2013-10-25 18:40 ` Dominick Grift
2013-10-26 11:58 ` Dominick Grift
2013-10-31 9:45 ` Dominick Grift
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1382645796.3041.159.camel@d30 \
--to=dominick.grift@gmail.com \
--cc=jwcart2@tycho.nsa.gov \
--cc=richard_c_haines@btinternet.com \
--cc=selinux@tycho.nsa.gov \
--cc=slawrence@tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.