Re: list of permissions created by allow2audit: what do i do now?

[Russell Coker <russell@coker.com.au>]

On Wed, 19 May 2004 01:11, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
>  /usr/bin/[xgkw]dm       -- system_u:object_r:xdm_exec_t
>
>  therefore, the programs gdm, xdm, kdm and wdm all have type xdm_exec_t
>  therefore, according to line 24 of domains/programs/xdm.te, gdm,
>  xdm, kdm and wdm are all allowed to automatically transition from
>  the initialisation context into a new context named xdm_t.

Yes, and they can also transition from initrc_t by line 21.  This is important 
because in Debian xdm is not started directly from init.

>  therefore, the programs gdm, xdm, kdm and wdm are all allowed to do
>  the things that are mentioned as allow xdm_t etc.

Yes.

>  okay, just a guess: when you declare an allow, are the relevant
>  permissions added or replaced if there already exists, say,
>  allow xdm_xserver_t var_lib_t:file { read };

Added.

>  and i then add, in a following line to policy.conf :
>  allow xdm_xserver_t var_lib_t:file { getattr };
>
>  do i end up with _only_ getattr permissions or do i end up
>  with both read _and_ getattr?

Both.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.