Re: mcs_systemhigh use

[Andy Warner <warner@rubix.com>]

On 6/10/2010 7:21 PM, Christopher J. PeBenito wrote:
> On Thu, 2010-06-10 at 19:12 +0800, Andy Warner wrote:
>    
>> On 6/10/2010 7:09 PM, Christopher J. PeBenito wrote:
>>      
>>> On Thu, 2010-06-10 at 17:15 +0800, Andy Warner wrote:
>>>
>>>        
>>>> In the policy for the Trusted RUBIX DBMS, we assign file contexts
>>>> using the following (only one representative dir, 'backups', shown):
>>>>
>>>> ifdef(`enable_mls',`
>>>> /var/lib/RUBIXdbms/backups(/.*)?
>>>> gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh)
>>>> ')
>>>> ifdef(`enable_mcs',`
>>>> /var/lib/RUBIXdbms/backups(/.*)?
>>>> gen_context(system_u:object_r:rubix_backup_t,mcs_systemhigh)
>>>> ')
>>>>
>>>> When using the mls policy, I get the expected level of mls_systemhigh
>>>> (s15:c0.c1023). But when using the targeted policy, I get an
>>>> unexpected value for mcs_systemhigh. I would expect to get
>>>> s0:c0.c1023, but get s0. I have verified this behavior on Fedora 9 and
>>>> 12. Is my assumption wrong about what mcs_systemhigh should be or am I
>>>> missing something?
>>>>
>>>> Relevant output from 'semanage fcontext -l'
>>>> /var/lib/RUBIXdbms/backups(/.*)?                   all files
>>>> system_u:object_r:rubix_backup_t:s0
>>>>
>>>>          
>>> Actually, you shouldn't need any of those ifdefs.  The gen_context()
>>> macro is sensitive to if MLS or MCS is enabled.  The first parameter is
>>> the first three fields of the context.  The second parameter is the MLS
>>> label, and there is a third optional parameter to specify the MCS
>>> categories for the file (there are no examples in refpolicy).  So this
>>> is sufficient:
>>>
>>> /var/lib/RUBIXdbms/backups(/.*)?     gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh,mcs_allcats)
>>>
>>> The thing to note is that gen_context() abstracts away the sensitivity
>>> (s0) portion of the label, so there is an mcs_allcats macro.
>>>
>>>        
>> Thanks for the reply. So, then is the mcs_systemhigh basically meaningless?
>>      
> Its useful for range transitions, eg:
>
> range_transition foo_t bar_t s0-mcs_systemhigh;
>    
In this case, whill mcs_systemhigh evaluate to s0 or s0:c0.c1023?

We use the following to allow a transition to system high, expecting for 
mcs that to be s0:c0.c1023. Should we expect that behavior or should we 
use mcs_allcats here as well?

ifdef(`enable_mls',`
     range_transition $1 $2:process mls_systemhigh;
')
ifdef(`enable_mcs',`
     range_transition $1 $2:process mcs_systemhigh;
')
> Perhaps we should consider changing the gen_context() macro to accept
> mcs_systemhigh instead of mcs_allcats, for consistency.
>    
At first glance it would sure seem mcs_systemhigh and mcs_allcats would 
(should?) evaluate to the same thing.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.