Re: [RFC][PATCH] selinux: enable authoritative granting of capabilities

[Casey Schaufler <casey@schaufler-ca.com>]

--- "Serge E. Hallyn" <serue@us.ibm.com> wrote:

> Quoting Stephen Smalley (sds@tycho.nsa.gov):
> > Extend SELinux to allow capabilities to be granted authoritatively.
> > Introduces a new cap_override access vector to indicate when the
> > secondary module (i.e. capability or dummy) check should be skipped.
> > Handle the new class gracefully even if the policy does not yet have
> > it defined.
> 
> Cool.
> 
> If we decide to have this take the place of the file capabilities i
> guess we're all set, but if both are going upstream, do you think
> CONFIG_SECURITY_FILE_CAPABILITIES and selinux should be mutually
> exclusive?

We're already living in a non-stacking LSM environment, so whatever
SELinux wants to do with capabilities is Stephen's affair, I suppose.
I assume that this is in preparation for file based capabilities
and dealing with interactions with them. My only concern is that you
seem to be sneaking around the "additional restrictions" LSM model,
with the justification being that the bit you're taking authority over
is also an LSM module. I am not convinced that you're completely
within the spirit of the thing, although I would hesitate to accuse
you of not playing nicely quite yet.



Casey Schaufler
casey@schaufler-ca.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.