review of a dbus-selinux patch

review of a dbus-selinux patch

[Colin Walters]

Hi,

Does anyone have comments on:
https://bugs.freedesktop.org/show_bug.cgi?id=71187

We expect people to be able to change major policy types without
recompiling userspace, correct?

The patch makes sense to me (just needs some style fixups per smcv's
comments).  However, from a quick look at the X.org xselinux code, it
looks like it also hardcodes e.g. SECCLASS_X_DRAWABLE; we'd need
a similar change there, right?




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: review of a dbus-selinux patch

[Stephen Smalley]

On 11/04/2013 10:26 AM, Colin Walters wrote:
> Hi,
> 
> Does anyone have comments on:
> https://bugs.freedesktop.org/show_bug.cgi?id=71187
> 
> We expect people to be able to change major policy types without
> recompiling userspace, correct?
> 
> The patch makes sense to me (just needs some style fixups per smcv's
> comments).  However, from a quick look at the X.org xselinux code, it
> looks like it also hardcodes e.g. SECCLASS_X_DRAWABLE; we'd need
> a similar change there, right?

XSELinux correctly uses selinux_set_mapping() so that libselinux
internally creates a mapping from arbitrary class/perm indices used by
XSELinux and the policy values and handles all of the translation at
runtime on avc_has_perm() calls.

dbusd can either do the same thing or it can start using
selinux_check_access() instead of directly calling the AVC at all.  Then
all of the SID/context, class, and perm lookups and AVC setup/usage is
transparent to the application, at some potential runtime overhead cost
(but doubt it is significant).  Same topic came up recently for
glibc/ncsd (subject:  Handling unknown permissions in userspace object
managers).



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: review of a dbus-selinux patch

[Colin Walters]

[-- Attachment #1: Type: text/plain, Size: 742 bytes --]

On Mon, 2013-11-04 at 12:06 -0500, Stephen Smalley wrote:

> XSELinux correctly uses selinux_set_mapping() so that libselinux
> internally creates a mapping from arbitrary class/perm indices used by
> XSELinux and the policy values and handles all of the translation at
> runtime on avc_has_perm() calls.

Ok, I see how this works now.  It was not obvious at all to me initially
that the order of the #defines in XSELinux had to correspond to the
security_class_mapping struct array.

But then I only discovered while writing a patch to document
selinux_set_mapping() that there are man pages now for the libselinux
API, and I guess the docs in the headers are not really used anymore?

Anyways I attached the patch...maybe it'll be useful.


[-- Attachment #2: 0001-selinux_set_mapping-Document-it.patch --]
[-- Type: text/x-patch, Size: 0 bytes --]

Re: review of a dbus-selinux patch

[Stephen Smalley]

On 11/07/2013 02:57 PM, Colin Walters wrote:
> On Mon, 2013-11-04 at 12:06 -0500, Stephen Smalley wrote:
> 
>> XSELinux correctly uses selinux_set_mapping() so that libselinux
>> internally creates a mapping from arbitrary class/perm indices used by
>> XSELinux and the policy values and handles all of the translation at
>> runtime on avc_has_perm() calls.
> 
> Ok, I see how this works now.  It was not obvious at all to me initially
> that the order of the #defines in XSELinux had to correspond to the
> security_class_mapping struct array.
> 
> But then I only discovered while writing a patch to document
> selinux_set_mapping() that there are man pages now for the libselinux
> API, and I guess the docs in the headers are not really used anymore?
> 
> Anyways I attached the patch...maybe it'll be useful.

Applied on #next.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.