[refpolicy] [PATCH] Add all the missing _admin interfaces to sysadm

[cpebenito@tresys.com (Christopher J. PeBenito)]

On 12/3/2014 10:29 AM, Jason Zaman wrote:
> 
> On 3 Dec 2014 18:27, "Dominick Grift" <dac.override@gmail.com
> <mailto:dac.override@gmail.com>> wrote:
>>
>> On Wed, 2014-12-03 at 08:56 -0500, Christopher J. PeBenito wrote:
>> > On 12/3/2014 8:42 AM, Jason Zaman wrote:
>> > > On Wed, Dec 03, 2014 at 08:18:46AM -0500, Christopher J. PeBenito
> wrote:
>> > >> On 12/3/2014 7:28 AM, Jason Zaman wrote:
>> > >>> Lots of the foo_admin() interfaces were not applied to sysadm. This
>> > >>> patch adds all the ones that were missing. Interfaces are added
> together
>> > >>> with the matching _role() interface if it was already present.
>> > >>>
>> > >>> Make all && make validate passes, but anyone else that can run
> any test
>> > >>> suites on this would be appreciated too.
>> > >>
>> > >> I'm not opposed to this change, but I wonder about cases like these:
>> > >>
>> > >>> +
>> > >>> +optional_policy(`
>> > >>> + asterisk_admin(sysadm_t, sysadm_r)
>> > >>>   asterisk_stream_connect(sysadm_t)
>> > >>>  ')
>> > >>
>> > >>>  optional_policy(`
>> > >>> + bacula_admin(sysadm_t, sysadm_r)
>> > >>>   bacula_run_admin(sysadm_t, sysadm_r)
>> > >>>  ')
>> > >>
>> > >> Since I would assume that the admin interface would already
> include the
>> > >> existing rule.
>> > >
>> > > Bacula_admin does indeed call _run_admin so i'll take that away,
>> > > asterisk does not call _stream_connect so that one is correct. I will
>> >
>> > I think there is still the question, should the stream connect be added
>> > to the admin interface?
>> >
>>
>> I would argue, no
>>
>> The application use to stream connect should instead be confined and
>> _admin should run that application with a domain transition instead
>>
> I think admining something and using it are not necessarily the same so
> I agree with Dominick, they should be separate.

I also agree.  The admin interfaces should have all of the rules needed
to admin the service, and that's it.  If that socket connect is not
related to an admin function, then it should remain separate.  I asked
the question since I was unsure why there was a stream connect.


> Along with stream connect, should _admin always call _role? It makes
> things complicated and was the reason I removed in the earlier patches.

No, the admin interfaces should probably never call role, since using a
service (in an unprivileged/client sense) is something different than
admining a service.


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com