Re: specifying groups of types

[Chris PeBenito <pebenito@gentoo.org>]

Well I tried this out, and it worked, though I used simple examples:

portage.te:
create_dir_notdevfile(portage_t,{file_type -shadow_t})

admin_macros.te:
# Relabel most files.
allow $1_t {file_type -shadow_t}:dir { getattr read search relabelfrom relabelto };
allow $1_t {file_type -shadow_t}:file_class_set { getattr relabelfrom relabelto };

(where portage is Gentoo's packaging system)  I don't know anything
about yacc, so I can't comment on the implementation.  But the new
shadow assertions are what the first IRC discussion stemmed from.  They
were (correctly) not tripped by these statements, and sysadm_t can stat
but not read /etc/shadow.

On Tue, 2003-10-14 at 13:56, David Caplan wrote:
> I'd recommend trying this out and if you find it useful change the parse 
> rules.  I tested it on some real basic policy, so it may cause other 
> unintended problems.  I'm throwing it out more as a starting point 
> rather than something intended to be integrated into checkpolicy.

> Stephen Smalley wrote:
> > On Sat, 2003-10-11 at 00:35, Russell Coker wrote:
> > 
> >>Following a discussion on IRC, it occurs to me that it would be handy to have 
> >>the following in the policy language:
> >>allow some_domain { file_type !shadow_t }:...
> >>
> >>So we can specify everything in file_type except for shadow_t.
-- 
Chris PeBenito
<pebenito@gentoo.org>
Developer, SELinux
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.