Re: RFC: Per-object manager controls in /selinux/config

[KaiGai Kohei <kaigai@ak.jp.nec.com>]

Eamon Walsh wrote:
> I am proposing adding a separate config line for each userspace object 
> manager, as follows:
> 
> #    permissive - SELinux prints warnings instead of enforcing.
> #    disabled - SELinux is fully disabled.
> SELINUX=enforcing
> +
> +# SELINUX_MANAGER= can take one of these four values
> +#    enforcing - SELinux security policy is enforced by this object 
> manager.
> +#    permissive - The object manager prints warnings instead of enforcing.
> +#    disabled - SELinux is fully disabled by this object manager.
> +#    default - The object manager will track the system setting.
> +SELINUX_DBUS=default
> +SELINUX_XSERVER=permissive
> +
> # SELINUXTYPE= type of policy in use. Possible values are:
> #    targeted - Only targeted network daemons are protected.
> #    strict - Full SELinux protection.

Eamon,

Could you tell me the purpose of this new feature?

It seems to me this new feature prevents to keep consistency of
the SELinux state. I think the internal state of userspace object
managers should be just a copy from the in-kernel reference monitor...

Thanks,

> However, I am a little unclear on how runtime setenforce calls should be 
> dealt with.  The way it currently works is if the userspace object 
> manager is initialized without an enforcing mode specified in the call 
> to avc_open(), it will track the system setting and conform to netlink 
> "setenforce" messages.  However, if avc_open() is called with an 
> enforcing mode specified, it will stay in that mode and not respond to 
> the netlink messages.  Users might thus be confused if they issue a 
> "setenforce 0" and the X server stays in enforcing mode because it was 
> specified that way in the config file.  But I'm of the opinion that 
> runtime setenforcing is an abnormal event, and anyone who edits the 
> config file away from "default" and then runs setenforce will understand 
> how it works.

-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.