Re: Latest diffs

[Daniel J Walsh <dwalsh@redhat.com>]

Christopher J. PeBenito wrote:
> On Fri, 2006-05-19 at 10:13 -0400, Daniel J Walsh wrote:
>   
>> Christopher J. PeBenito wrote:
>>     
>>> On Thu, 2006-05-18 at 11:56 -0400, Daniel J Walsh wrote:
>>>       
>>>> Added unconfined_execmem_exec_t so that I can change the global 
>>>> allow_execmem to off.  OpenOffice, valgrind and mplayer need it.  
>>>> Probably could eliminate java, and wine domain and change to this.
>>>>     
>>>>         
>>> I think this would be better if we had this transparently integrated
>>> into the unconfined policy.  So we just add the rules to unconfined.te,
>>> and put the domain transition into unconfined_domtrans().  The
>>> differences between the two domains is just the execmem, so it should be
>>> ok.  In fact this might be a simple example of hierarchy.
>>>       
>
> So basically, we want unconfined_execmem_t to be the exact same as
> unconfined_t, except have execmem too.  So the best way to do that would
> be to have the unconfined interfaces also act on unconfined_execmem_t.
> For example:
>
> interface(`unconfined_domtrans',`
> 	domain_auto_trans($1,unconfined_exec_t,unconfined_t)
> 	domain_auto_trans($1,unconfined_execmem_exec_t,unconfined_execmem_t)
> ')
>   
No because this would allow xdm, xdm_xserver_t, firstboot ... to 
transion.  All we want is

domain_auto_trans(unconfined_t,unconfined_execmem_exec_t,unconfined_execmem_t)

> interface(`unconfined_dbus_send',`
> 	allow $1 { unconfined_t unconfined_execmem_t }:dbus send_msg;
> ')
>
>   


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.