Re: MySQL Policy Patch

[Russell Coker <russell@coker.com.au>]

On Tue, 19 Oct 2004 02:34, Stephen Smalley <sds@epoch.ncsc.mil> wrote:
> Think about the security implications:  Do you want a compromised mysqld
> to be able to read arbitrary admin temporary files?  Not likely.  So

 allow mysqld_t sysadm_home_dir_t:dir search;
 allow mysqld_t sysadm_home_t:file { read getattr };

The above rules which are already in the policy are worse.

The mysql situation needs improvement.  Firstly I think that the temporary 
file should be created under /var/lib/mysql to remove the need for /tmp 
access.  Then we need to do something about /root/.my.conf, maybe move it to 
some place under /etc.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.