Re: [RFC][PATCH] selinux: enable authoritative granting of capabilities

[Casey Schaufler <casey@schaufler-ca.com>]

--- Russell Coker <russell@coker.com.au> wrote:

> On Wednesday 13 June 2007 22:31, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> > On Wed, 2007-06-13 at 21:16 +1000, Russell Coker wrote:
> > > On Wednesday 13 June 2007 01:57, Stephen Smalley <sds@tycho.nsa.gov> 
> wrote:
> > > > Well, first, no script should be allowed a capability that is not given
> > > > to its caller directly ;)
> > >
> > > Why not?  Isn't that the entire point of this authoritative granting of
> > > capabilities patch?
> >
> > _script_, not program.
> 
> OK, that's a bit of a topic change.
> 
> I've been thinking about the script issue.  It seems to me that a problem we 
> face is the replacement of executables by scripts (which often happens in 
> distributions and sometimes happens with programs that are relevant to system
> 
> integrity).

That should only be a problem on a name based system, right?

OK, sorry for the dig. Anyhow, it seems that the program that
sets the policy (labels the file system?) ought to be checking
the "type" of the file if it matters. You also might consider
that as 21st century programming (special purpose scripting)
replaces 20th century programming (general purpose binaries)
fewer people are going to be tolerent of a distintion between
a "program" and a "script" and look seriously at how you might
avoid having to treat them differently.


Casey Schaufler
casey@schaufler-ca.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.