Re: New SELinux userspace release supporting extended ioctl permissions?

[Dominick Grift <dac.override@gmail.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Fri, Nov 06, 2015 at 10:37:35AM -0500, Paul Moore wrote:
> Now that Linux 4.3 has been released with the extended ioctl permissions, are 
> we planning to make a new userspace release so that we can take advantage of 
> this new functionality?  I believe all the necessary patches have been merged, 
> no?
> 

Are you referring to anything in particular?

There is already some support: https://github.com/SELinuxProject/selinux/commit/ef93dfe0393c4a60483c3f7729dd98a2f886606a

Applying ioctl whitelisting on GNU/Linux systems looks to me pretty hard
to do though. Many drivers, and their ioctls to support.

I also had a hard time determining what is what. This tool[1] helped a
little but it is still very hard to add support for the appropriate
ioctls to the appropriate interfaces.

- From a policy perspective I am just going to wait it out for now, see where
androids' sepolicy goes with this. I think they have the benefit of
limited hardware to support.

[1] https://bitbucket.org/billcroberts/fixup/src/0e49a67015a98f856199e41d1681117b4ae179b5/ioctl.c?at=master

- -- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
https://sks-keyservers.net/pks/lookup?op=get&search=0x314883A202DFF788
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQGcBAEBCgAGBQJWPNS3AAoJENAR6kfG5xmcp+4MAJX3wIdQElrLifArveurVbOD
WVzcdFPtPVw9AL3SBM8A8Crjkc463STcwlv8S+lGpQWo3fpes60uIYK/+0sxN1r7
BFFYdisf+WtRQvC070kCBB+bmNejs8zX6Tz4XoV1yXG5EpuoPecn4EPT7vylg8Gm
+3s0gkqrOeTDZ+MW+HfKOZgxNHASvHDSwnCt+U9f9a2TINx1ceoN/r5vGLCB0dvQ
EXBtPjHSKFGAPGLF7xqq397OdofHxMBEfZbogsxyPXAJeF9/CuAIhKHQOcSA3waV
k5cAF7snEcYD9NpU965An+a1TcjAotxwYSj1SoTeJns6ZxQmZHfI1STKMaJBQpAv
GGJD7aNxBwzYYiUt4v9SIGVq+B0hrJpa/vm+rGNyc/f6ra3LZdRz9BpM9rwFV0eS
Qv2uYrkkcB3XC7t4gfYtmaa0ERRolsMfwDufAwhXFWrmgLktGB1RKWbwEc/TytKp
C6NmP3VunZzA0RwbQIMccuWQSKj+DxCtVmQQ7GYX+w==
=PTyE
-----END PGP SIGNATURE-----