Re: Fedora Core 7 has frozen and Fedora 8 Development has started

[Joshua Brindle <method@manicmethod.com>]

Todd Miller wrote:
> Joshua Brindle wrote:
>   
>> What does allowable file context mean?
>>
>> You need to be able to do an analysis on the policy to see what user
>> can relabelfrom and what they can relabelto. If they can't
>> relabelfrom the file being modified in nautilus then nothing should
>> appear, otherwise the types they can relabelto would appear.   
>>     
>
> A security_get_file_sids() function was added to the security server
> that takes a usersid and a class (was always SECLASS_FILE) and returns a
> list of sids that the user has relabelto permissions.  It was probably
> not really sufficient for the task as it doesn't take relabelfrom into
> account (it predates any hacking I did on SEDarwin, though I did stop it
> from panicing).
>
> The kernel code in question is still online at:
> http://sedarwin.org/cgi-bin/cvsweb/sedarwin8/policies/sedarwin/sedarwin/
> ss/services.c
>   
it also ignores other parts of a context so it isn't really sufficient, 
if the type can be relabeledfrom and to but the user is different a 
contraint will prevent the relabel, for example. It also doesn't take 
any mls/mcs into account.

I also think it isn't appropriate to do analysis of the policy in the 
kernel, a better alternative might be to make a kernel interface to 
output the policydb that an apol-like daemon could read and perform 
queries on when requested.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.