Re: I think this is a bug in the kernel

[Daniel J Walsh <dwalsh@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel J Walsh wrote:
| https://bugzilla.redhat.com/show_bug.cgi?id=445709
|
| libvirtd is clearly not ptracing the unconfined_t domain.  It is
| problably looking under /proc for some information about the app that is
| communicating with it.  It might be reading unconfined_t environment.  I
| am not sure, but we generate a ptrace and stop the app from working.  My
| only choice is to allow virtd to ptrace unconfined_t processes which is
| not a good idea.  This has to be fixes in the kernel.
|
| Dan

- --
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
with
the words "unsubscribe selinux" without quotes as the message.

Replying to my own email...

Looks like the kernel has it on its todo list...

~ *  Finer-grained proc checking (so that we don't require full ptrace
permission just to read process state),

Well I think we need to jump the priority here.

User apps seem to be doing things like looking at the remote end of the
socket and checking the environment for special cookies in the case of
consolehelper/policykit.  Or may looking to see where the kerberos
tickets are located.  Whether this is a legitimate use or not, it is
being done.  So we need to handle it.  But I have a real concern about
allowing virtd_t to ptrace unconfined_t process.

Basically in order to allow virtd_t to verify the unconfined_t process
that is trying to communicate with it, we need to allow it to read the
memory of every unconfined_t process on the system.  Not good.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkgkXNYACgkQrlYvE4MpobOC4ACcChtet42S8Y7ffL0l82Eb4FDM
zJEAn2Kxb9sx2SXP87kTUMvbiIurarH8
=3qY6
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.