Re: Patch to cleanup audit handling in policy.

[Daniel J Walsh <dwalsh@redhat.com>]

Christopher J. PeBenito wrote:
> On Mon, 2007-04-30 at 10:25 -0400, Daniel J Walsh wrote:
>   
>> Christopher J. PeBenito wrote:
>>     
>>> On Fri, 2007-04-27 at 16:38 -0700, Steve G wrote:
>>>   
>>>       
>>>>> I have removed -send_audit_msgs_pattern and replaced it with 4 functions 
>>>>>       
>>>>>           
>>>> I'd like to clarify what they are in case anyone thinks the names need tweeking
>>>>
>>>> logging_send_audit_msg - This is for any Trusted App that needs to send audit
>>>> events
>>>>
>>>> logging_set_loginuid - This would be for entry point daemons or daemons that
>>>> perform actions on behalf of a user (cron/at). Includes the ability to send audit
>>>> events.
>>>>
>>>> logging_set_audit - This should be for the audit daemon only
>>>>
>>>> logging_set_auditctl - This is only for auditctl and autrace.
>>>>     
>>>>         
>>> I'm not convinced that these are necessary.  The assertions in the
>>> policy are mainly to stop people from accidentally shooting themselves
>>> in the foot by allowing potentially dangerous access, for example,
>>> access to /etc/shadow or raw disk access.
>>>
>>>   
>>>       
>> When I reviewed the policy, almost ever call to allow audit was wrong.  
>>     
>
> Wrong in what sense?
>
>   

Wrong in the sense of granting more privs then they intended.  Login 
programs being able to change the audit rules.  audit_control versus 
audit_write and netlinkmsg_write versus netlinkmsg_relay.  Better to put 
them into interfaces and force policy writers to use them.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.