Re: permissions on /proc/self/attrib/current

[Chuck Mead <csm@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1157 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stephen Smalley wrote:
> On Tue, 2006-06-06 at 13:53 -0400, Chuck Mead wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> The file /proc/self/attrib/current is world read and write. Is this
>> correct? Why does it need world read and write?
> 
> To completely disable DAC restrictions, and leave it entirely to SELinux
> to control access.  The corresponding hook functions in the SELinux
> "module", selinux_getprocattr and selinux_setprocattr, apply permission
> checks on reading and writing these nodes, and selinux_setprocattr
> further prohibits a task from setting (writing) attributes other than
> its own.
> 
> The DAC restrictions can be problematic when the task becomes
> undumpable, e.g. setuid or setgid programs could otherwise lose access
> to their own /proc/pid/attr nodes.

If selinux is disabled is this file still present?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFEjW/xZfy0juH51WsRAtwCAJ0bFY7+YKxe7sr9WgQCvx8VY4okcgCgkVT/
EVDRmiSlQ48BC0s3EdkpvNo=
=44pn
-----END PGP SIGNATURE-----

[-- Attachment #2: csm.vcf --]
[-- Type: text/x-vcard, Size: 376 bytes --]

begin:vcard
fn:Chuck Mead
n:Mead;Chuck
org:Red Hat, Inc.;GPS,
adr:;;1801 Varsity Drive;Raleigh;NC;27606;USA
email;internet:csm@redhat.com
title:Consultant
tel;cell:919-621-0605
note;quoted-printable:You can have peace. Or you can have freedom. Don=E2=80=99t ever count onh=
	aving both at once. - Lazarus Long
x-mozilla-html:FALSE
url:http://redhat.com
version:2.1
end:vcard