Re: File Browsing apps and getattr

[Daniel J Walsh <dwalsh@redhat.com>]

Ivan Gyurdiev wrote:

>>Tightened up a little bit.
>>define(`file_browse_domain', `
>># Do not flood message log, if the user does a browse
>>dontaudit $1 file_type - secure_file_type:dir_file_class_set getattr;
>>dontaudit $1 dev_fs:dir_file_class_set getattr;
>>dontaudit $1 file_type - secure_file_type:dir read;
>>')dnl end file_browse_domain
>>    
>>
>
>I don't like how security types are being excluded as being special.
>I understand the concern, but that will cause audited denials for proper
>use of applications like ls. 
>
>  
>
Doing ls of Kerberos keyfiles, certs and shadow or any other security 
file should probably be audited in
a strict policy, because the next thing would be an attempt at a read.  
It might be usefull to know that the
latest mozilla plugin is poking around some more secure files.  
Dontaudit would just cover this up.

>Stephen Smalley:
>"Yes, shadow_t would fall into that class.  So at that point you might
>dontaudit attempts to getattr it from user domains, while leaving them
>audited for the daemon domains."
>
>I don't think daemon domains should be using this file_browse_domain
>in the first place - seems to me like it should be used only for user
>domains. For smbd, for example, something more specialized could be used
>like the patch I posted which is restricted to $1_file_type only
>(since we don't allow arbitrary samba shares through the filesystem
>anyway)
>
>Will user_t be using this macro? 
>  
>
Yes.  There already was similar code in the base_user_macros.te file.

Dan

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.