Re: SELinux and access(2), we want to know.

["Serge E. Hallyn" <serue@us.ibm.com>]

Quoting Daniel J Walsh (dwalsh@redhat.com):
> Totally useless and gives the SELinux SUCKS crowd more ammunition. If  
> the MLS people want to treat ACCESS==OPEN then we are going to have a  
> big boolean/tunable flag for their paranoia.  For everyone else.  Lets  
> try to figure out when an application is actually doing something evil.

I'm really not here to be difficult, but if you believe that a failed
open is a problem bc an attacker can poke around the fs, and you believe
that nautilus can be hacked, then ignoring access just doesn't make
sense.  The fact that users are being inconvenienced doesn't change
that.

Jamie's point (obscured in code because it is implemented through
the use of fsuid) that for DAC purposes access and open use different
creds, is useful.  I can buy that audit should spit out a slightly
different message to show that MAC failed on real cred attempt
instead of subj...  (Even though the values of uid, euid, and fsuid
in the audit msg should make that clear).

So in that case, given how the code is structured currently in
fs/{open,namei}.c and through inode_permission, an extra flag
which selinux simply uses to judge which audit msg (if any) to
spit out seems the simplest way to do it.

-serge