From: Joshua Brindle <jbrindle@tresys.com>
To: Dale Amon <amon@vnl.com>
Cc: Russell Coker <russell@coker.com.au>,
"Christopher J. PeBenito" <cpebenito@tresys.com>,
SELinux Mail List <selinux@tycho.nsa.gov>
Subject: Re: Remove unrestricted_admin
Date: Sat, 25 Sep 2004 20:13:33 -0400 [thread overview]
Message-ID: <415609AD.5000808@tresys.com> (raw)
In-Reply-To: <20040925220708.GB15912@vnl.com>
Dale Amon wrote:
>On Sun, Sep 26, 2004 at 01:21:10AM +1000, Russell Coker wrote:
>
>
>>Corner cases that happen to be a regular part of any sys-admin's job.
>>
>>
>
>I massively agree. Lots of people do 'ghosting'; lots
>of people back up entire disk images before doing
>something dangerous. Now I've got ways around a lot
>of the problems anyway because I've a root boot floppy
>I use. Boot a machine off an nfs root; mount a Real Big
>Disk over nfs, and then dd the whole frigging host
>system disk to the destination system where it
>can be worked on.
>
>Although it is not my primary use for this (mostly I
>do R&D), think forensics too. Think of all the various
>tools in use for setting up a master image and dupping
>it to N other machines.
>
>Also, dd with a decent block speed is an awesomely
>fast way to back up a disk.
>
>
>
I _really_ hope you aren't suggesting that you do a dd from a host disk
to something else while a machine is in production. This _will_ lead to
an inconsistant image and I don't think I need to explain why.
This corner case shouldn't determine what is in the default policy, but
I'm not even sure that is what we are talking about here, Russell never
said how he wants this implemented (keep the unrestricted_admin macro or
put that unrestricted fixed disk access in the standard policy. At any
rate, I hope very much that noone expects or desires that this be put in
unconditionally. Raw disk access is a very obvious attack vector and
must be treated as such, period.
Again, these backup kinds of activities are always privileged and thus
need to be in a domain where they can do only backup procedures, whether
that be reading the on-disk files (preferable and correct if you use
real backup software) or raw disk access.
Joshua Brindle
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2004-09-26 0:13 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-09-21 5:26 file.te and tmpfs Russell Coker
2004-09-22 20:22 ` James Carter
2004-09-23 13:32 ` Remove unrestricted_admin Daniel J Walsh
2004-09-23 19:09 ` James Carter
2004-09-24 15:05 ` Russell Coker
2004-09-24 17:50 ` Christopher J. PeBenito
2004-09-24 18:27 ` Russell Coker
2004-09-24 18:59 ` Christopher J. PeBenito
2004-09-24 19:13 ` Russell Coker
2004-09-24 22:22 ` Luke Kenneth Casson Leighton
2004-09-25 10:39 ` Russell Coker
2004-09-25 11:01 ` Luke Kenneth Casson Leighton
2004-09-25 13:30 ` Christopher J. PeBenito
2004-09-25 15:21 ` Russell Coker
2004-09-25 17:09 ` Chris PeBenito
2004-09-25 17:45 ` Russell Coker
2004-09-25 22:07 ` Dale Amon
2004-09-26 0:13 ` Joshua Brindle [this message]
2004-09-26 9:21 ` Dale Amon
2004-09-26 9:53 ` Russell Coker
2004-09-26 10:35 ` Luke Kenneth Casson Leighton
2004-09-25 23:06 ` Joe Nall
2004-09-26 13:16 ` Russell Coker
2004-09-24 18:49 ` Joshua Brindle
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=415609AD.5000808@tresys.com \
--to=jbrindle@tresys.com \
--cc=amon@vnl.com \
--cc=cpebenito@tresys.com \
--cc=russell@coker.com.au \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.