[refpolicy] kdbus support

[dwalsh@redhat.com (Daniel J Walsh)]

On 08/03/2015 11:40 AM, Stephen Smalley wrote:
> On 08/03/2015 10:33 AM, Daniel J Walsh wrote:
>>
>> On 08/03/2015 09:27 AM, Stephen Smalley wrote:
>>> On 08/03/2015 08:31 AM, Miroslav Grepl wrote:
>>>> I am working on kdbus support on Fedora 24. Basically we need to add
>>>> support for
>>>>
>>>> /sys/fs/kdbus
>>>>
>>>> and I am thinking about correct labeling. Something like
>>>>
>>>> +type kdbusfs_t;
>>>> +fs_type(kdbusfs_t)
>>>> +files_mountpoint(kdbusfs_t)
>>>> +dev_associate_sysfs(kdbusfs_t)
>>>> +genfscon kdbusfs / gen_context(system_u:object_r:kdbusfs_t,s0)
>>>>
>>>> What do you think about kdbusfs_t label?
>>> Until kdbus has LSM hooks, it should not be accessible by anything.
>>> Otherwise, it is a completely uncontrolled IPC mechanism by which
>>> anything is free to violate policy on the system.
>>>
>>>
>>> _______________________________________________
>>> refpolicy mailing list
>>> refpolicy at oss.tresys.com
>>> http://oss.tresys.com/mailman/listinfo/refpolicy
>> Well Rawhide is totally broken right now, and everyone has to boot in
>> permissive mode.
>>
>> We need to allow this for now and then fix the kernel.
>>
> Is it unreasonable to require Fedora developers to test with SELinux
> enforcing before submitting changes?  Especially systemd...
>
I am sure the developers would argue that the whole process would ground
to a halt.