Re: Default Policy question?

[Tom <tom@lemuria.org>]

On Tue, Jun 03, 2003 at 09:51:59AM +1000, Russell Coker wrote:
> > * his home directory (environment)
> > * policy and policy tools
> > * kernel and kernel modules
> 
> So who runs debugfs/fdisk/mkfs?

Note that I'm not trying to protect against DESTRUCTION of the system,
but against subversion.


> > Other than that, all other tools are limited by the policy, aren't
> > they? The sysadm_r can replace ls with a trojaned binary, but he can't
> > make it do anything that the normal ls isn't allowed to do.
> 
> When "ls" is run by any userdomain it does not trigger a domain transition.  
> If ls is compromised it's game-over, ls can do lots of interesting things 
> other than list the stats of files if it wants to...

But if I control the policy, I can add an auto_trans rule. bin_exec_t
could auto_trans to sysadm_t so the sysadm gains nothing by trojaning
any binary. :)

I didn't say the default policy is good enough for this. I'm just
trying to figure out whether it's possible at all.


-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.