Re: File Browsing apps and getattr

[Daniel J Walsh <dwalsh@redhat.com>]

Stephen Smalley wrote:

>On Wed, 2005-02-02 at 09:07, Daniel J Walsh wrote:
>  
>
>>Added file_browse_domain to latest policy
>>
>>define(`file_browse_domain', `
>># Do not flood message log, if the user does a browse
>>allow $1 file_type - secure_file_type:file getattr;
>>dontaudit $1 dev_fs:dir_file_class_set getattr;
>>dontaudit $1 sysadmfile:file getattr;
>>dontaudit $1 sysadmfile:dir read;
>>')dnl end file_browse_domain
>>    
>>
>
>  
>
Tightened up a little bit.
define(`file_browse_domain', `
# Do not flood message log, if the user does a browse
dontaudit $1 file_type - secure_file_type:dir_file_class_set getattr;
dontaudit $1 dev_fs:dir_file_class_set getattr;
dontaudit $1 file_type - secure_file_type:dir read;
')dnl end file_browse_domain


>Not clear why you want the dontaudit rules for sysadmfile, and it seems
>like there would be a lot of overlap between the dontaudit getattr rule
>and the allow getattr rule, meaning that you are wasting an access
>vector in most cases.  
>
>  
>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.