From: Paul Moore <paul.moore@hp.com>
To: James Morris <jmorris@namei.org>
Cc: selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org,
Eric Paris <eparis@redhat.com>,
Stephen Smalley <sds@tycho.nsa.gov>
Subject: Re: [RFC PATCH v6 08/13] SELinux: Add new peer permissions to the Flask definitions
Date: Mon, 12 Nov 2007 11:34:35 -0500 [thread overview]
Message-ID: <200711121134.35273.paul.moore@hp.com> (raw)
In-Reply-To: <Xine.LNX.4.64.0711120926410.7114@us.intercode.com.au>
On Sunday 11 November 2007 5:31:44 pm James Morris wrote:
> On Fri, 9 Nov 2007, Paul Moore wrote:
> > Add additional Flask definitions to support the new "peer" object class.
>
> Should this be dependent on dynamic class/permission support?
I think it's okay to _define_ the Flask definitions regardless of what the
policy supports as older policies should simply ignore these definitions.
> Or, will these checks only be invoked if labled networking is configured?
Bingo! Look at patch 7/13, specifically the 'selinux_policycap_netpeer'
variable and then at patch 9/13 where the new access checks are made
conditional on this variable. The whole mess needs more testing and
verification, but "in theory" it shouldn't cause any breakage with older
policies ... if someone does notice something broken please scream loudly.
--
paul moore
linux security @ hp
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2007-11-12 16:34 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-11-09 21:23 [RFC PATCH v6 00/13] Labeled networking patches Paul Moore
2007-11-09 21:23 ` [RFC PATCH v6 01/13] NetLabel: remove unneeded RCU read locks Paul Moore
2007-11-09 21:23 ` [RFC PATCH v6 02/13] NetLabel: cleanup the LSM domain hash functions Paul Moore
2007-11-09 21:24 ` [RFC PATCH v6 03/13] NetLabel: consolidate the LSM domain mapping/hashing locks Paul Moore
2007-11-09 21:24 ` [RFC PATCH v6 04/13] NetLabel: Add secid token support to the NetLabel secattr struct Paul Moore
2007-11-09 21:24 ` [RFC PATCH v6 05/13] SELinux: add secctx_to_secid() LSM hook Paul Moore
2007-11-09 22:19 ` Casey Schaufler
2007-11-10 1:21 ` Paul Moore
2007-11-11 6:27 ` Casey Schaufler
2007-11-09 21:24 ` [RFC PATCH v6 06/13] NetLabel: add IP address family information to the netlbl_skbuff_getattr() function Paul Moore
2007-11-09 21:24 ` [RFC PATCH v6 07/13] SELinux: Add a capabilities bitmap to SELinux policy version 22 Paul Moore
2007-11-09 21:24 ` [RFC PATCH v6 08/13] SELinux: Add new peer permissions to the Flask definitions Paul Moore
2007-11-11 22:31 ` James Morris
2007-11-12 16:34 ` Paul Moore [this message]
2007-11-09 21:24 ` [RFC PATCH v6 09/13] SELinux: Better integration between peer labeling subsystems Paul Moore
2007-11-11 22:34 ` James Morris
2007-11-12 16:40 ` Paul Moore
2007-11-09 21:24 ` [RFC PATCH v6 10/13] SELinux: Enable dynamic enable/disable of the network access checks Paul Moore
2007-11-09 21:24 ` [RFC PATCH v6 11/13] SELinux: allow NetLabel to directly cache SIDs Paul Moore
2007-11-09 21:24 ` [RFC PATCH v6 12/13] NetLabel: introduce static network labels for unlabeled connections Paul Moore
2007-11-09 21:25 ` [RFC PATCH v6 13/13] NetLabel: add auditing to the static labeling mechanism Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200711121134.35273.paul.moore@hp.com \
--to=paul.moore@hp.com \
--cc=eparis@redhat.com \
--cc=jmorris@namei.org \
--cc=linux-security-module@vger.kernel.org \
--cc=sds@tycho.nsa.gov \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.