Re: Bug#193644: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=193644 (cron upstream patch)

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Thu, May 20, 2004 at 08:06:36AM -0400, Stephen Smalley wrote:

> >  "system" is like... a privilege ABOVE root, and i presume its
> >  closest equivalent is to the "SYSTEM" SID on the NT
> >  (actually VAX/VMS) security model.
> 
> No.  It is just a way of distinguishing system processes from user
> processes.  

 oh, okay :)

 i stand corrected.

> >  i think this can be resolved by adding an extra argument to
> >  process_crontab.  to put that another way: if an extra
> >  argument is added which is used solely the selinux context,
> >  the issue you have, steve, over the change from *system*
> >  to system_u goes away.
> 
> I don't think that this is necessary; it sounds like we can use the
> username field, assuming that it can be system_u for system cron jobs
> (or something else that is easily recognizable and can be mapped to
> system_u by the SELinux code).

 then that leaves the other approach, the one suggested by russell:
 to do a strcmp(fname, "*system*") == 0 in process_crontab, and
 in that specific case to call get_default_context("system_u", ...)

 i don't think steve is going to allow any changes upstream to crond
 because the letters "system_u" _could_ be a valid username used
 by a NON selinux enabled system in /etc/passwd or other security
 system.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.