Re: kernel/kernel.* diffs

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1733 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Christopher J. PeBenito wrote:
| On Fri, 2008-05-23 at 10:34 -0400, Daniel J Walsh wrote:
|> Mainly adding additional dontaudits for permissive domains.
|
|> Subject: [PATCH] refpolicy: kernel_kernel changes
|> --text follows this line--
|> --- nsaserefpolicy/policy/modules/kernel/kernel.if	2008-05-23
09:15:06.224337000 -0400
|> +++ serefpolicy-3.4.1/policy/modules/kernel/kernel.if	2008-05-23
10:29:05.107838000 -0400
|> @@ -1198,6 +1198,7 @@
|>  	')
|>
|>  	dontaudit $1 proc_type:dir list_dir_perms;
|> +	dontaudit $1 proc_type:file getattr;
|>  ')
|>
|>  ########################################
|> @@ -1768,6 +1769,7 @@
|>  	')
|>
|>  	dontaudit $1 sysctl_type:dir list_dir_perms;
|> +	dontaudit $1 sysctl_type:file read_file_perms;
|>  ')
|>
|>  ########################################
|
| These two violate the intention of the interface.
|
I though the intention of the interface was to dontaudit list of all
proc or sysctl.  I believe this means we know this app tries to list
sysctl or proc so dontaudit the listing.  Well part of the listing in
permissive mode is the getattr or read.  So to make this work the way
customers would expect we need to add interfaces all over the place and
patch every call to this will a dontaudit file, which seems to be a
colossal waste of time.

Maybe we need a way to indicate whether this should be dontaudited in
enforcing mode versus permissive.

Added patch for

cgroup_t.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkhQBckACgkQrlYvE4MpobM7GwCfTcHGsZQV8ZRuKTD9I6/YJ2e4
snkAoM+HSsJzbfDEfAvXfxb0ZeXbZWo/
=j1e0
-----END PGP SIGNATURE-----

[-- Attachment #2: kernel_kernel.patch --]
[-- Type: text/plain, Size: 449 bytes --]

--- nsaserefpolicy/policy/modules/kernel/kernel.te	2008-06-11 08:15:43.000000000 -0400
+++ serefpolicy-3.4.1/policy/modules/kernel/kernel.te	2008-06-11 10:06:56.000000000 -0400
@@ -45,6 +45,15 @@
 sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
 
 #
+# cgroup fs
+#
+
+type cgroup_t;
+fs_type(cgroup_t)
+allow cgroup_t self:filesystem associate;
+genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0)
+
+#
 # DebugFS
 #
 
+

[-- Attachment #3: kernel_kernel.patch.sig --]
[-- Type: application/pgp-signature, Size: 72 bytes --]