Re: [PATCH 4/6] Add dynamic context transition support to SELinux

[Chris Wright <chrisw@osdl.org>]

* Stephen Smalley (sds@epoch.ncsc.mil) wrote:
> On Thu, 2004-12-02 at 14:18, Chris Wright wrote:
> > No, I was thinking of actually tracking the threads, since you know when
> > they come and go.  One way would be to share task_security_struct via
> > refcnt for threads, although this could get sticky.
> 
> Hmm...that would be a significant change, and I'm not clear that the
> existing security_task_alloc() hook even allows for it (no clone_flags
> passed to it).  ptrace_sid could also be an issue for sharing.

True, guess that's filed under "sticky" ;-)

> Note that the mm checking logic is already after one permission check
> (setcurrent), which will only be allowed to the small set of privileged
> processes that use this feature.  That acts as the gatekeeper for any
> use of this feature, then the dyntransition check controls the possible
> transitions among security contexts using this feature.  In the case of
> exec-based transitions, the corresponding transition check is deferred
> until the actual exec processing.  So even as it stands, arbitrary
> processes aren't allowed to reach the code in question, which is better
> than the [gs]etpriority cases.

OK, I misread that any threaded app could write to /proc/self/attr/current
and trigger that loop, only to fail the avc lookup.  Yes, now I see the
PROCESS__SETCURRENT test, thanks.

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net