Re: support for fireflight reading /proc/NNN/fd and /proc/NNN/exe

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, Jun 08, 2004 at 01:11:10PM -0400, Stephen Smalley wrote:
> On Mon, 2004-06-07 at 19:21, Thomas Bleher wrote:
> > Not the macro directly, otherwise all domains which use can_ps() will be
> > affected. If you really need that much access, you should probably add a
> > rule like
> >         allow fireflier_t file_type:file_class_set getattr;
> >         allow fireflier_t domain:{ socket_class_set fifo_file } getattr;
> > But this seems just too broad (see below).
> 
> Definitely too broad.  Use dontaudit rules to suppress the audit
> messages, and only allow it what it truly needs to function.
 
 i've spoken to martin and he accepted a patch on fireflight
 to restrict the stat operations to only those files where
 the symlink name begins with "socket:".

 if anyone with severe linux kernel knowledge (and isn't afraid
 to admit it) can forsee any problems with that approach, please do
 say so!

 martin says the code to do the /proc/<pid>/ walking he
 cut/paste from netstat so gawd only knows what horrors netstat
 gets up to.

 lsof i'd kinda expect to be better behaved and to know a few
 more kernel /proc tricks but for the life of me i can't work
 it out.  i seriously can't be bothered, the code is monster
 spaghetti and looks totally unmaintainable.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.