Re: blocking security xattr changes when policy is not loaded

[Arkadiusz Miskiewicz <arekm@pld-linux.org>]

Dnia Wednesday 10 of March 2004 13:50, Stephen Smalley napisał:

> SELinux still performs its regular processing even without the policy
> load; it is just that any permission checks are allowed until a policy
> is loaded.  The setxattr() is not failing due to a permission check; it
> is failing because selinux_inode_setxattr() attempts to convert the
> context to a SID (via security_context_to_sid) in preparation for making
> permission checks, and the context is unknown to the security server
> (policy engine) because no policy has been loaded.  The security server
> can't just blindly accept contexts and provide SIDs; it needs to have an
> internal representation of the context that it can understand.
Don't know the internals but why it can't blindly accept? No policy, so 
nothing to do with selinux stuff. If any permission checks are allowed so no 
need to check anything (no need to security_context_to_sid()) right?

> In any event, note is_selinux_enabled() should return 0 when no policy
> is loaded, so if the pwdutils code was bracketing SELinux-related
> processing with if (is_selinux_enabled() > 0), it wouldn't even try to
> do this.
That's bad - I wrote why. I will lose security xattr on the file!
When I load policy things will go really bad since /etc/shadow file won't have 
proper security context.

-- 
Arkadiusz Miśkiewicz     CS at FoE, Wroclaw University of Technology
arekm.pld-linux.org, 1024/3DB19BBD, JID: arekm.jabber.org, PLD/Linux


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.