Re: policies for DJ Bernstein tools

[Petre Rodan <petre.rodan@ravantivirus.com>]

[-- Attachment #1: Type: text/plain, Size: 4191 bytes --]

On Sun, Nov 30, 2003 at 12:41:15AM +1100, Russell Coker wrote:
> On Sun, 30 Nov 2003 00:21, Petre Rodan <petre.rodan@ravantivirus.com> wrote:
> > > I have added your changes to qmail.te and qmail.fc to my tree, it'll be
> > > on my site in a few minutes.  I have modified them slightly so you will
> > > want to check that they still do what you require.  I removed the
> > > user_home_t label for the qmail alias directory as I don't think that's
> > > an appropriate type. Maybe etc_qmail_t will work.
> >
> > acording to Dave Sill's 'life with qmail' install guide (the best one out
> > there) alias is a pseudo-user that gets the mails that did not have a valid
> > recipient on the server. I gave him a user_home_t so he gets mail without
> > other modifications done to qmail_local_t.
> 
> This will require more investigation.  However ~alias is different from a 
> regular user home directory, and it seems unlikely that you would want user_r 
> to write to it.  So therefore user_home_t seems like the wrong type for it.
> 
> We could create a new qmail_home_t type which has attributes home_type and 
> user_home_type to allow qmail to access it.

qmail_home_t sounds just perfect to me.

my only requirement would be that sysadm_t should be able to have full access there.
ezmlm (http://www.ezmlm.org) has a lot of binaries that fool around with files in ~alias.
the manager of the list (usualy sysadm_t) should be able to make his job inside
~alias without new policy rules. maybe it would be even simpler to make ~alias a
sysadm_home_t. just a thought.

> > > What is clockspeed?
> >
> > it's a SNTP client available here:
> > http://cr.yp.to/clockspeed.html
> >
> > the big difference between clockspeed and ntpd is the number of exploits
> > ...
> 
> So why not have clockspeed run in ntpd_t?

clockspeed uses some files (cs_atto_t, cs_etc_t) and a cs_adjust_t fifo that kinda 
makes him unique (or maybe I am wrong?)

anyhow, I'm still investigating the usefulness of some of the rules i wrote.
the locations of some of the files should be also changed in the distro.
his adition should be postponed.

> > I understand, I will definitely rewrite that part somehow.
> > The reason I made this context is because I have a lot of scripts (eighter
> > run through ssh or by crond_t) that send mail with attachments using mutt.
> 
> Doesn't mutt just run "sendmail -t"?  If not why not?  If so then why doesn't 
> it get staff_mail_t for the sendmail process?

i use qmail on all my machines. he comes with a sendmail of his own located in 
/var/qmail/bin/sendmail. 
/usr/sbin/sendmail is a symlink to /var/qmail/bin/sendmail, and both are labeled as
system_u:object_r:bin_t
so there is no domain_auto_trans to staff_mail_t.

maybe we should label them the way sendmail is labeled on your machine and 
voila, no more problems.

> > you use the cvs.sourceforge.net:/cvsroot/selinux repository?
> > just to make sure we use the same source ...
> 
> I maintain my own policy tree based on the NSA release plus all patches that 
> flow through this list and other sources.  It often varies significantly from 
> the CVS, but at the moment there is not much difference.

ok, got that.

thanks for your help,
peter

> -- 
> http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
> http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
> http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
> http://www.coker.com.au/~russell/  My home page
> 

-- 

Petre Rodan
Senior Network Engineer
GeCAD Software - RAV Division

----------------------------------------------------------------------
Tel/Fax: +40-21-321-7803
Hotline:  +40-21-321-7859

This message is confidential. It may also be privileged or otherwise 
protected by work product immunity or other legal rules. It may contain
personal views which are not the views of the GeCAD unless specifically
stated. 
If you have received it in error, please delete it from your system. 
Do not use, copy or disclose the information in any way nor act in 
reliance on it and notify the sender immediately.

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]