* container and staff_t
@ 2025-08-29 10:20 Russell Coker
2025-08-30 18:22 ` Kenton Groombridge
0 siblings, 1 reply; 2+ messages in thread
From: Russell Coker @ 2025-08-29 10:20 UTC (permalink / raw)
To: SELinux Reference Policy mailing list
grep -R container_user_role policy/
policy/modules/roles/staff.te: container_user_role(staff, staff_t,
staff_application_exec_domain, staff_r)
policy/modules/services/container.if:template(`container_user_role',`
Why is staff_t the only domain for container_user_role() ?
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: container and staff_t
2025-08-29 10:20 container and staff_t Russell Coker
@ 2025-08-30 18:22 ` Kenton Groombridge
0 siblings, 0 replies; 2+ messages in thread
From: Kenton Groombridge @ 2025-08-30 18:22 UTC (permalink / raw)
To: Russell Coker; +Cc: SELinux Reference Policy mailing list
[-- Attachment #1: Type: text/plain, Size: 758 bytes --]
On 25/08/29 08:20PM, Russell Coker wrote:
> grep -R container_user_role policy/
> policy/modules/roles/staff.te: container_user_role(staff, staff_t,
> staff_application_exec_domain, staff_r)
> policy/modules/services/container.if:template(`container_user_role',`
>
> Why is staff_t the only domain for container_user_role() ?
>
When the container policy was originally written, it was only tested
with staff_t and unconfined_t at the time.
The other roles (mostly user_t) should probably also be allowed to use
it but I would personally rather it be a tunable for each given the
amount of attack surface that unprivilged containers can still expose.
If we did that, staff_t should probably be tunable as well.
---
Kenton Groombridge
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 963 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-08-30 18:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-29 10:20 container and staff_t Russell Coker
2025-08-30 18:22 ` Kenton Groombridge
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.