Re: [PATCH] refpolicy: kernel_kernel changes

[Daniel J Walsh <dwalsh@redhat.com>]

Christopher J. PeBenito wrote:
> On Thu, 2007-08-02 at 16:04 -0400, dwalsh@redhat.com wrote:
>   
>> Additional interfaces for kernel access
>>
>> @@ -1848,6 +1866,27 @@
>>
>>  ########################################
>>  ## <summary>
>> +##     Read the process state (/proc/pid) of all unlabeled_t.
>> +## </summary>
>> +## <param name="domain">
>> +##     <summary>
>> +##     Domain allowed access.
>> +##     </summary>
>> +## </param>
>> +#
>> +interface(`kernel_read_unlabeled_state',`
>> +       gen_require(`
>> +               type unlabeled_t;
>> +       ')
>> +
>> +       allow $1 unlabeled_t:dir list_dir_perms;
>> +       read_files_pattern($1,unlabeled_t,unlabeled_t)
>> +       read_lnk_files_pattern($1,unlabeled_t,unlabeled_t)
>> +')
>>     
>
> I'm concerned about this interface since unlabled_t is used for domains
> and objects.  Someone using this interface might not realize the
> specified domain can now also read other unlabeled files.
>
>   
The only domain that gets assigned this is sysadm_t.  I believe this was 
needed in order to kill processes that were in the unlabeled state.  For 
example if a sysadm unloads a policy file for a running process.  The 
process goes wild eating up all of cpu, and he can't kill it or even see 
which process is causing the problem.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.