All of lore.kernel.org
 help / color / mirror / Atom feed
* v2 Skip role attributes for policy.X and downgraded pp
@ 2011-08-16  8:08 Harry Ciao
  2011-08-16  8:08 ` [v2 PATCH 1/1] Skip writing " Harry Ciao
                   ` (2 more replies)
  0 siblings, 3 replies; 7+ messages in thread
From: Harry Ciao @ 2011-08-16  8:08 UTC (permalink / raw)
  To: slawrence; +Cc: selinux


Differnece from v1
--------------------
1. Skip role attributes when pp is downgraded, as well as for policy.X.

   When pp is downgraded the flavor flag and roles ebitmap would be
   discarded, resulting in role attributes useless at all. So in such
   case role attributes should be skipped for pp too.


Tests I've done
-----------------
1. Apply the role attribute test patch from Chris, adding a new test_r
   role and calls rpm_run() for it.
   
2. Use the apol tool to analyze what types the test_r role could type with:
   (Since the apol installed on Ubuntu so far only support max version .24,
    we need to setup "policy-version = 24" in semanage.conf)
   
Note: 
. There is no role attributes such as portage/semanage/rpm_roles in policy.24
. By default pp's version is 13.

test_r (36 types)
    bootloader_t
    chfn_t
    chkpwd_t
    consoletype_t
    ddclient_t
    depmod_t
    dhcpc_t
    groupadd_t
    hostname_t
    ifconfig_t
    insmod_t
    iptables_t
    ldconfig_t
    load_policy_t
    loadkeys_t
    lvm_t
    netutils_t
    newrole_t
    nscd_t
    pam_t
    passwd_t
    ping_t
    pppd_t
    pptp_t
    prelink_t
    rpm_script_t
    rpm_t
    semanage_t
    setfiles_t
    test_t
    traceroute_t
    tzdata_t
    updpwd_t
    useradd_t
    usernetctl_t
    utempter_t

3. In write_binary_policy() in checkmodule.c, trigger pp downgrade
   by adding "policyvers = MOD_POLICYDB_VERSION_MAX - 1;", then use
   apol to analyze what types the test_r role could type with:

Note:
. After downgrade, pp's version is 12 now.

test_r (22 types)
    chfn_t
    chkpwd_t
    consoletype_t
    ddclient_t
    dhcpc_t
    hostname_t
    ifconfig_t
    insmod_t
    iptables_t
    loadkeys_t
    netutils_t
    newrole_t
    pam_t
    passwd_t
    ping_t
    pppd_t
    pptp_t
    test_t
    traceroute_t
    updpwd_t
    usernetctl_t
    utempter_t

   Where we can see that test_r could no longer type with all those
   types that are typed by rpm_roles and semanage_roles.

   (BTW, this means that once role attributes are endorsed in refpolicy,
    the influence of pp downgrade could be far-reaching and perhaps
    undesirable.)

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2011-08-23 13:47 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-08-16  8:08 v2 Skip role attributes for policy.X and downgraded pp Harry Ciao
2011-08-16  8:08 ` [v2 PATCH 1/1] Skip writing " Harry Ciao
2011-08-22 13:47 ` v2 Skip " HarryCiao
2011-08-22 14:04   ` Eric Paris
2011-08-22 16:09 ` Christopher J. PeBenito
2011-08-23  1:08   ` Harry Ciao
2011-08-23 13:47     ` Christopher J. PeBenito

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.