From: Gionatan Danti <g.danti@assyoma.it>
To: Dominick Grift <dominick.grift@defensec.nl>
Cc: "Christian Göttsche" <cgzones@googlemail.com>, selinux@vger.kernel.org
Subject: Re: lnk_file read permission
Date: Fri, 31 Jul 2020 21:49:01 +0200 [thread overview]
Message-ID: <ddebf7e0ac775d521e86c023decf9bbb@assyoma.it> (raw)
In-Reply-To: <ypjl1rkrmpul.fsf@defensec.nl>
Il 2020-07-31 21:44 Dominick Grift ha scritto:
> Everyone who has business in /var/lib should probably be able to read
> var_lib_t lnk_files.
I agree.
> You can use audit2allow to allow these entities to read symlinks of
> type var_lib_t
Sure, but I would like to avoid policy customization outside what can be
done via semanage.
> Again though, there is a larger picture here and I would argue that
> your
> distribution maintainer should acknowledge that.
Yeah, I opened a BZ agaist it.
Do you think this also affect the reference policy? Should I write to
the selinux-policy mailing list?
Thanks.
--
Danti Gionatan
Supporto Tecnico
Assyoma S.r.l. - www.assyoma.it
email: g.danti@assyoma.it - info@assyoma.it
GPG public key ID: FF5F32A8
next prev parent reply other threads:[~2020-07-31 19:49 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-31 9:57 lnk_file read permission Gionatan Danti
2020-07-31 13:12 ` Stephen Smalley
2020-07-31 16:56 ` Gionatan Danti
2020-07-31 16:25 ` Christian Göttsche
2020-07-31 16:53 ` Dominick Grift
2020-07-31 17:09 ` Gionatan Danti
2020-07-31 19:37 ` Gionatan Danti
2020-07-31 19:44 ` Dominick Grift
2020-07-31 19:49 ` Gionatan Danti [this message]
2020-07-31 17:00 ` Gionatan Danti
2020-07-31 17:45 ` Dominick Grift
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ddebf7e0ac775d521e86c023decf9bbb@assyoma.it \
--to=g.danti@assyoma.it \
--cc=cgzones@googlemail.com \
--cc=dominick.grift@defensec.nl \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.