[refpolicy] Restricting access to pcscd socket

[cpebenito@tresys.com (Christopher J. PeBenito)]

On 2/14/2014 2:47 PM, Luis Ressel wrote:
> The policy grants the right to access the pcscd socket (PC/SC daemon, a daemon
> for accessing smartcards) to some domains which rarely need it: xguest_t,
> mozilla_plugin_t and kerberos users (through kerberos_use()). While there are
> use cases which require this access, most do not, and access to a smartcard is
> something rather critical. Therefore I propose to make this permission a
> tunable.
> 
> There are some other domains which are granted this access (openct_t,
> certmonger_t, certwatch_t, and after my last patch also gpg_agent_t), but they
> are specifically crypto-related and should be well-protected, so I decided to
> leave their permissions unconditional. (Sure, kerberos is also crypto-related,
> but in that policy, the right is granted to any application using kerberos, not
> only a separate process.)
> 
> What do you think?

Typically I would take something like this.  Conditionally making the policy stricter is usually a good thing.  I'm not so sure that it makes sense here.  It doesn't seem like it buys much.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com