* [PATCH] selinux: drop unused packet flow permissions
@ 2011-02-23 2:54 Eric Paris
2011-02-23 13:40 ` Christopher J. PeBenito
0 siblings, 1 reply; 5+ messages in thread
From: Eric Paris @ 2011-02-23 2:54 UTC (permalink / raw)
To: selinux; +Cc: sds, jmorris
These permissions are not used and can be dropped in the kernel
definitions.
Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Eric Paris <eparis@redhat.com>
---
security/selinux/include/classmap.h | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index e9a8eb7..fffd855 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -132,8 +132,7 @@ struct security_class_mapping secclass_map[] = {
{ "appletalk_socket",
{ COMMON_SOCK_PERMS, NULL } },
{ "packet",
- { "send", "recv", "relabelto", "flow_in", "flow_out",
- "forward_in", "forward_out", NULL } },
+ { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } },
{ "key",
{ "view", "read", "write", "search", "link", "setattr", "create",
NULL } },
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] selinux: drop unused packet flow permissions
2011-02-23 2:54 [PATCH] selinux: drop unused packet flow permissions Eric Paris
@ 2011-02-23 13:40 ` Christopher J. PeBenito
2011-02-23 13:57 ` Stephen Smalley
0 siblings, 1 reply; 5+ messages in thread
From: Christopher J. PeBenito @ 2011-02-23 13:40 UTC (permalink / raw)
To: Eric Paris; +Cc: selinux, sds, jmorris
On 02/22/11 21:54, Eric Paris wrote:
> These permissions are not used and can be dropped in the kernel
> definitions.
>
> Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
> Signed-off-by: Eric Paris <eparis@redhat.com>
> ---
>
> security/selinux/include/classmap.h | 3 +--
> 1 files changed, 1 insertions(+), 2 deletions(-)
>
> diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
> index e9a8eb7..fffd855 100644
> --- a/security/selinux/include/classmap.h
> +++ b/security/selinux/include/classmap.h
> @@ -132,8 +132,7 @@ struct security_class_mapping secclass_map[] = {
> { "appletalk_socket",
> { COMMON_SOCK_PERMS, NULL } },
> { "packet",
> - { "send", "recv", "relabelto", "flow_in", "flow_out",
> - "forward_in", "forward_out", NULL } },
> + { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } },
> { "key",
> { "view", "read", "write", "search", "link", "setattr", "create",
> NULL } },
I'm concerned about this. Won't this break refpolicy? I can't keep two
sets of object class definitions around for systems that still have the
flow_in and flow_out perms.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] selinux: drop unused packet flow permissions
2011-02-23 13:40 ` Christopher J. PeBenito
@ 2011-02-23 13:57 ` Stephen Smalley
0 siblings, 0 replies; 5+ messages in thread
From: Stephen Smalley @ 2011-02-23 13:57 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: Eric Paris, selinux, jmorris
On Wed, 2011-02-23 at 08:40 -0500, Christopher J. PeBenito wrote:
> On 02/22/11 21:54, Eric Paris wrote:
> > These permissions are not used and can be dropped in the kernel
> > definitions.
> >
> > Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
> > Signed-off-by: Eric Paris <eparis@redhat.com>
> > ---
> >
> > security/selinux/include/classmap.h | 3 +--
> > 1 files changed, 1 insertions(+), 2 deletions(-)
> >
> > diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
> > index e9a8eb7..fffd855 100644
> > --- a/security/selinux/include/classmap.h
> > +++ b/security/selinux/include/classmap.h
> > @@ -132,8 +132,7 @@ struct security_class_mapping secclass_map[] = {
> > { "appletalk_socket",
> > { COMMON_SOCK_PERMS, NULL } },
> > { "packet",
> > - { "send", "recv", "relabelto", "flow_in", "flow_out",
> > - "forward_in", "forward_out", NULL } },
> > + { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } },
> > { "key",
> > { "view", "read", "write", "search", "link", "setattr", "create",
> > NULL } },
>
> I'm concerned about this. Won't this break refpolicy? I can't keep two
> sets of object class definitions around for systems that still have the
> flow_in and flow_out perms.
This just removes the entries in the kernel table so that the kernel
does not try to look up these permission strings in the policy. As the
kernel is now dynamically mapping class/perm values, we don't need to
keep placeholders in its tables for obsolete permissions that are not in
use within the kernel (no hook function in the current kernel uses these
permissions). But we will keep the definitions in refpolicy for older
kernels that predate the dynamic class/perm mappings.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] selinux: drop unused packet flow permissions
@ 2011-02-23 2:54 Eric Paris
2011-02-23 15:22 ` Stephen Smalley
0 siblings, 1 reply; 5+ messages in thread
From: Eric Paris @ 2011-02-23 2:54 UTC (permalink / raw)
To: selinux; +Cc: sds, jmorris
These permissions are not used and can be dropped in the kernel
definitions.
Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Eric Paris <eparis@redhat.com>
---
security/selinux/include/classmap.h | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index e9a8eb7..fffd855 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -132,8 +132,7 @@ struct security_class_mapping secclass_map[] = {
{ "appletalk_socket",
{ COMMON_SOCK_PERMS, NULL } },
{ "packet",
- { "send", "recv", "relabelto", "flow_in", "flow_out",
- "forward_in", "forward_out", NULL } },
+ { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } },
{ "key",
{ "view", "read", "write", "search", "link", "setattr", "create",
NULL } },
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] selinux: drop unused packet flow permissions
2011-02-23 2:54 Eric Paris
@ 2011-02-23 15:22 ` Stephen Smalley
0 siblings, 0 replies; 5+ messages in thread
From: Stephen Smalley @ 2011-02-23 15:22 UTC (permalink / raw)
To: Eric Paris; +Cc: selinux, jmorris
On Tue, 2011-02-22 at 21:54 -0500, Eric Paris wrote:
> These permissions are not used and can be dropped in the kernel
> definitions.
>
> Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
> Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
>
> security/selinux/include/classmap.h | 3 +--
> 1 files changed, 1 insertions(+), 2 deletions(-)
>
> diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
> index e9a8eb7..fffd855 100644
> --- a/security/selinux/include/classmap.h
> +++ b/security/selinux/include/classmap.h
> @@ -132,8 +132,7 @@ struct security_class_mapping secclass_map[] = {
> { "appletalk_socket",
> { COMMON_SOCK_PERMS, NULL } },
> { "packet",
> - { "send", "recv", "relabelto", "flow_in", "flow_out",
> - "forward_in", "forward_out", NULL } },
> + { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } },
> { "key",
> { "view", "read", "write", "search", "link", "setattr", "create",
> NULL } },
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2011-02-23 15:22 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-02-23 2:54 [PATCH] selinux: drop unused packet flow permissions Eric Paris
2011-02-23 13:40 ` Christopher J. PeBenito
2011-02-23 13:57 ` Stephen Smalley
-- strict thread matches above, loose matches on Subject: below --
2011-02-23 2:54 Eric Paris
2011-02-23 15:22 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.