From: "Christopher J. PeBenito" <cpebenito@tresys.com>
To: dE <de.techno@gmail.com>, <selinux@tycho.nsa.gov>
Subject: Re: Significance of SELinux user and roles on objects.
Date: Tue, 20 May 2014 09:42:43 -0400 [thread overview]
Message-ID: <537B5BD3.4090507@tresys.com> (raw)
In-Reply-To: <537AE191.7070403@gmail.com>
On 05/20/2014 01:01 AM, dE wrote:
> I've read that the roles on objects (like files) are in reality of no use and are filled up just for the sake of filling. That's why every file has role object_r.
>
> Which prompts me a question -- do the user and role of objects (like files) have any significance? Or can access be allowed/denied based on the object's role and user?
Roles on objects typically don't have any use. The kernel will create files with object_r regardless, so putting a role on a file can't easily be made useful right now. For example, I added user_tmp_t to the user_r so I could label a directory:
$ chcon user_u:user_r:user_tmp_t .
$ ls -laZ
total 12K
drwxr-xr-x. 2 pebenito users user_u:user_r:user_tmp_t 6 May 20 09:25 .
drwxrwxrwt. 127 root root system_u:object_r:tmp_t 8.0K May 20 09:25 ..
And then I touch a file:
$ touch test
$ ls -laZ
total 12K
drwxr-xr-x. 2 pebenito users user_u:user_r:user_tmp_t 17 May 20 09:27 .
drwxrwxrwt. 127 root root system_u:object_r:tmp_t 8.0K May 20 09:25 ..
-rw-r--r--. 1 pebenito users user_u:object_r:user_tmp_t 0 May 20 09:27 test
So the new file still gets object_r instead of user_r. If you do have a role on an object, you can write constraints in the policy based on the role of the object. If the role was correctly set on objects, I would use the role on objects to enforce role separations in refpolicy.
The user is useful on some objects, as the basic constraints in refpolicy will deny creating or relabeling a file if the user of the process doesn't match the user of the file. If you have UBAC turned on in refpolicy, then the user separations will be enforced across all relevant object classes.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
next prev parent reply other threads:[~2014-05-20 13:41 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-20 5:01 Significance of SELinux user and roles on objects dE
2014-05-20 13:42 ` Christopher J. PeBenito [this message]
2014-05-22 6:55 ` dE
2014-05-22 7:32 ` Dominick Grift
2014-05-23 5:01 ` dE
2014-05-23 13:42 ` Stephen Smalley
2014-05-23 15:45 ` dE
2014-05-23 15:55 ` Stephen Smalley
2014-05-24 3:39 ` dE
2014-05-27 12:36 ` Christopher J. PeBenito
2014-05-27 12:51 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=537B5BD3.4090507@tresys.com \
--to=cpebenito@tresys.com \
--cc=de.techno@gmail.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.