* kudzu fixes to allow it to edit and restart init for MLS
@ 2007-04-20 19:30 dwalsh
2007-04-30 14:24 ` Christopher J. PeBenito
0 siblings, 1 reply; 4+ messages in thread
From: dwalsh @ 2007-04-20 19:30 UTC (permalink / raw)
To: cpebenito; +Cc: selinux
p--- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-04-10 12:52:58.000000000 -0400
+++ serefpolicy-2.5.12/policy/modules/admin/kudzu.te 2007-04-11 17:07:34.000000000 -0400
@@ -21,8 +21,8 @@
# Local policy
#
-allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config mknod };
-dontaudit kudzu_t self:capability { sys_ptrace sys_tty_config };
+allow kudzu_t self:capability { dac_override sys_admin sys_ptrace sys_rawio net_admin sys_tty_config mknod };
+dontaudit kudzu_t self:capability sys_tty_config;
allow kudzu_t self:process { signal_perms execmem };
allow kudzu_t self:fifo_file rw_fifo_file_perms;
allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };
@@ -103,6 +103,8 @@
init_use_fds(kudzu_t)
init_use_script_ptys(kudzu_t)
init_stream_connect_script(kudzu_t)
+init_read_init_state(kudzu_t)
+init_ptrace_init_domain(kudzu_t)
# kudzu will telinit to make init re-read
# the inittab after configuring serial consoles
init_telinit(kudzu_t)
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: kudzu fixes to allow it to edit and restart init for MLS
2007-04-20 19:30 kudzu fixes to allow it to edit and restart init for MLS dwalsh
@ 2007-04-30 14:24 ` Christopher J. PeBenito
2007-04-30 14:31 ` Daniel J Walsh
0 siblings, 1 reply; 4+ messages in thread
From: Christopher J. PeBenito @ 2007-04-30 14:24 UTC (permalink / raw)
To: dwalsh; +Cc: selinux
On Fri, 2007-04-20 at 15:30 -0400, dwalsh@redhat.com wrote:
> p--- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-04-10 12:52:58.000000000 -0400
> +++ serefpolicy-2.5.12/policy/modules/admin/kudzu.te 2007-04-11 17:07:34.000000000 -0400
> @@ -21,8 +21,8 @@
> # Local policy
> #
>
> -allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config mknod };
> -dontaudit kudzu_t self:capability { sys_ptrace sys_tty_config };
> +allow kudzu_t self:capability { dac_override sys_admin sys_ptrace sys_rawio net_admin sys_tty_config mknod };
> +dontaudit kudzu_t self:capability sys_tty_config;
> allow kudzu_t self:process { signal_perms execmem };
> allow kudzu_t self:fifo_file rw_fifo_file_perms;
> allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };
> @@ -103,6 +103,8 @@
> init_use_fds(kudzu_t)
> init_use_script_ptys(kudzu_t)
> init_stream_connect_script(kudzu_t)
> +init_read_init_state(kudzu_t)
> +init_ptrace_init_domain(kudzu_t)
> # kudzu will telinit to make init re-read
> # the inittab after configuring serial consoles
> init_telinit(kudzu_t)
Kudzu really needs to ptrace init?
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: kudzu fixes to allow it to edit and restart init for MLS
2007-04-30 14:24 ` Christopher J. PeBenito
@ 2007-04-30 14:31 ` Daniel J Walsh
2007-04-30 14:36 ` Christopher J. PeBenito
0 siblings, 1 reply; 4+ messages in thread
From: Daniel J Walsh @ 2007-04-30 14:31 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: selinux
Christopher J. PeBenito wrote:
> On Fri, 2007-04-20 at 15:30 -0400, dwalsh@redhat.com wrote:
>
>> p--- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-04-10 12:52:58.000000000 -0400
>> +++ serefpolicy-2.5.12/policy/modules/admin/kudzu.te 2007-04-11 17:07:34.000000000 -0400
>> @@ -21,8 +21,8 @@
>> # Local policy
>> #
>>
>> -allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config mknod };
>> -dontaudit kudzu_t self:capability { sys_ptrace sys_tty_config };
>> +allow kudzu_t self:capability { dac_override sys_admin sys_ptrace sys_rawio net_admin sys_tty_config mknod };
>> +dontaudit kudzu_t self:capability sys_tty_config;
>> allow kudzu_t self:process { signal_perms execmem };
>> allow kudzu_t self:fifo_file rw_fifo_file_perms;
>> allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };
>> @@ -103,6 +103,8 @@
>> init_use_fds(kudzu_t)
>> init_use_script_ptys(kudzu_t)
>> init_stream_connect_script(kudzu_t)
>> +init_read_init_state(kudzu_t)
>> +init_ptrace_init_domain(kudzu_t)
>> # kudzu will telinit to make init re-read
>> # the inittab after configuring serial consoles
>> init_telinit(kudzu_t)
>>
>
> Kudzu really needs to ptrace init?
>
>
I am not sure, you can merge it with a dontaudit, and we can get the
LSPP People to test without it.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: kudzu fixes to allow it to edit and restart init for MLS
2007-04-30 14:31 ` Daniel J Walsh
@ 2007-04-30 14:36 ` Christopher J. PeBenito
0 siblings, 0 replies; 4+ messages in thread
From: Christopher J. PeBenito @ 2007-04-30 14:36 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: selinux
On Mon, 2007-04-30 at 10:31 -0400, Daniel J Walsh wrote:
> Christopher J. PeBenito wrote:
> > On Fri, 2007-04-20 at 15:30 -0400, dwalsh@redhat.com wrote:
> >
> >> p--- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-04-10 12:52:58.000000000 -0400
> >> +++ serefpolicy-2.5.12/policy/modules/admin/kudzu.te 2007-04-11 17:07:34.000000000 -0400
> >> @@ -21,8 +21,8 @@
> >> # Local policy
> >> #
> >>
> >> -allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config mknod };
> >> -dontaudit kudzu_t self:capability { sys_ptrace sys_tty_config };
> >> +allow kudzu_t self:capability { dac_override sys_admin sys_ptrace sys_rawio net_admin sys_tty_config mknod };
> >> +dontaudit kudzu_t self:capability sys_tty_config;
> >> allow kudzu_t self:process { signal_perms execmem };
> >> allow kudzu_t self:fifo_file rw_fifo_file_perms;
> >> allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };
> >> @@ -103,6 +103,8 @@
> >> init_use_fds(kudzu_t)
> >> init_use_script_ptys(kudzu_t)
> >> init_stream_connect_script(kudzu_t)
> >> +init_read_init_state(kudzu_t)
> >> +init_ptrace_init_domain(kudzu_t)
> >> # kudzu will telinit to make init re-read
> >> # the inittab after configuring serial consoles
> >> init_telinit(kudzu_t)
> >>
> >
> > Kudzu really needs to ptrace init?
> >
> >
> I am not sure, you can merge it with a dontaudit, and we can get the
> LSPP People to test without it.
I'm thinking that we should probably put the process ptrace dontaudit
back into ps_process_pattern(). Ever since it was removed, theres been
a noticeable increase in ptrace rules popping up.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-04-30 14:37 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-04-20 19:30 kudzu fixes to allow it to edit and restart init for MLS dwalsh
2007-04-30 14:24 ` Christopher J. PeBenito
2007-04-30 14:31 ` Daniel J Walsh
2007-04-30 14:36 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.