Re: [RFC] Ability to allow unknown class and permissions

[Joshua Brindle <jbrindle@tresys.com>]

Karl MacMillan wrote:
> Joshua Brindle wrote:
>>> From: Karl MacMillan [mailto:kmacmillan@mentalrootkit.com]
>>> Joshua Brindle wrote:
> 
> <snip>
> 
>>>
>>>   Or Why would you need #1 if you have
>>>> #2? I thought the config flag was for the kernel..
>>> To allow the policy file to be analyzed without external reference.
>>>
>>
>> Second time analysis was mentioned and still wrong (IMO). You can't
>> analyze unknown permissions since the kernel which the kernel is
>> inserted into also decides whether the permissions are checked.
>>
> 
> But you can tell if unknown permissions will be allowed (and even which 
> object classes and permissions for a specific kernel) without reference 
> to the _configuration_ of a specific system. You only need to look at 
> the policy and the version of the kernel / userspace components. That 
> is, in my opinion, an important difference.
> 

Unless there is a permission associated with setting this option (via 
semanage or similar) you don't buy anything. And I'm not sure what value 
you get out of knowing unknown permissions are allowed or denied in an 
analysis anyway.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.