From: Steve Grubb <sgrubb@redhat.com>
To: redhat-lspp@redhat.com
Cc: James Antill <jantill@redhat.com>,
linux-audit@redhat.com, Stephen Smalley <sds@tycho.nsa.gov>,
selinux@tycho.nsa.gov
Subject: Re: Re: [patch] Full relabel audit event
Date: Tue, 30 May 2006 10:08:16 -0400 [thread overview]
Message-ID: <200605301008.16564.sgrubb@redhat.com> (raw)
In-Reply-To: <1148666614.20976.258.camel@moss-spartans.epoch.ncsc.mil>
On Friday 26 May 2006 14:03, Stephen Smalley wrote:
> I don't see the point when a) you only want it in that one case,
We do this already in several places. For example, we instrumented usermod,
but not chage. It was documented in the Security Target that usermod should
be used to alter user account attributes.
> b) it doesn't prevent trivial bypass in any way (e.g. by using restorecon,
> by rolling your own program to do it, by running setfiles on /* rather than
> just /, ...), and
Its not meant to be bulletproof. Its purpose is to document that a full
relabel has occurred before any user can log in. During the boot process, no
one can log in so nothing evil should happen.
> Note btw that setfiles already provides three different ways to log
> actual changes in file contexts, the original -v verbose mode, and the
> -l (log via syslog) and -o <file> (log to file) modes introduced later
> by Red Hat. That at least provides detailed information that the caller
> couldn't determine otherwise.
It was determined that we only need 1 record, not all the changes.
-Steve
--
redhat-lspp mailing list
redhat-lspp@redhat.com
https://www.redhat.com/mailman/listinfo/redhat-lspp
next prev parent reply other threads:[~2006-05-30 14:08 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-05-25 21:01 [patch] Full relabel audit event James Antill
2006-05-26 17:05 ` Stephen Smalley
2006-05-26 17:47 ` James Antill
2006-05-26 18:03 ` [redhat-lspp] " Stephen Smalley
2006-05-30 14:08 ` Steve Grubb [this message]
2006-05-30 13:22 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200605301008.16564.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=jantill@redhat.com \
--cc=linux-audit@redhat.com \
--cc=redhat-lspp@redhat.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox