Re: banning copying of binaries (e.g. mozilla etc).

[Joshua Brindle <jbrindle@tresys.com>]

Stephen Smalley wrote:

> On Tue, 2004-08-31 at 12:25, Joshua Brindle wrote:
> 
>>It's worth noting that this will not stop execution of said binaries 
>>entirely. One only needs to know enough to use /lib/ld.so to run any 
>>dynamically linked binary which he doesn't have execute access on. 
>>Unfortunatly disabling user domains access to ld.so would make him 
>>unable to run any dynamically linked apps whatsoever, sounds like we 
>>need a userland enforcer in glibc ;)
> 
> 
> Running it via ld.so should still trigger SELinux permission checks for
> read and execute (upon the mmap) and possibly other checks induced by
> earlier operations by ld.so (e.g. stat'ing the file will require
> getattr), so this only has an affect on the execute_no_trans check.
> 
> With regard to the latter point, the kernel doesn't check
> execute_no_trans to the interpreter when handling an execve itself, so
> you can remove execute_no_trans permission to ld.so from a domain to
> prevent direct execution while still allowing the kernel to invoke it on
> behalf of the process upon an execve.
> 

Ah, my mistake. Out of curiousity why does the ld_so_t have execute 
permission in the uses_shlib macro if the kernel is executing it? Does 
the kernel still check for execute permission for the current domain 
before it executes ld.so?

Joshua Brindle

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.