Re: list of permissions created by allow2audit: what do i do now?

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, May 18, 2004 at 08:40:47AM -0400, Stephen Smalley wrote:
> On Tue, 2004-05-18 at 06:40, Luke Kenneth Casson Leighton wrote:
> > from the list, below, i've removed me editing syslog as root without
> > doing newrole -r system_r :)
> 
> sysadm_r, not system_r.
 
 hey, given that i haven't allowed my useraccount to do newrole
 to _either_ of those...

> > 	allow initrc_t xdm_rw_etc_t:dir { add_name remove_name write };
> > 	allow initrc_t xdm_rw_etc_t:file { create ioctl rename unlink write };
> > 
> > i mean, i see in domains/programs/xdm.te that there _are_
> > allow initrc_t xdm_rw_etc_t permissions for create (create_file_perms)
> > and also a comment that init scripts want to check for update
> > windowmanagerlist so they get getattr and read allowed.
> > 
> > ... so what's going on?? why am i getting these messages?
> 
> In the upstream policy, I see:
> $ grep 'allow initrc_t xdm_rw_etc_t' policy.conf
> allow initrc_t xdm_rw_etc_t:file { getattr read };
> 
> So initrc_t is presently only allowed to stat and read those files. 
> Now, there are other rules for xdm_t:
> $ grep 'allow xdm_t xdm_rw_etc_t' policy.conf
> allow xdm_t xdm_rw_etc_t:dir { read getattr lock search ioctl add_name remove_name write };
> allow xdm_t xdm_rw_etc_t:file { create ioctl read getattr lock write setattr append link unlink rename };
> 
> And the xdm.te source file does have a comment prior to the
> corresponding source statements that says that this is for wdm.
> But perhaps someone erred and submitted the wrong rules for wdm (we
> don't use it ourselves).

 okay, maybe this is a silly question.

 given the number of errors i am seeing, and given that they won't
 go away, perhaps there is some breakdown in communication between
 the rules being in the policy.conf file and their application to
 packages.

 for example, should i be doing a make relabel every time i add
 some new rules?

 should i force setfiles usage just like there is in
 /etc/dpkg/postinst.d/selinux?

 am i on the right track, here?

> > if i am using wdm (the patched version) is there anything i need to
> > do to get it to work / be accepted?
> 
> Don't know, as I've never used it.

 ah.  then i will try.... xdm, and see what happens.

 (wdm is the patched one from daniel walsh).

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.