All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stephen Smalley <sds@tycho.nsa.gov>
To: David Miller <davem@davemloft.net>
Cc: auke-jan.h.kok@intel.com, e1000-devel@lists.sourceforge.net,
	netdev@vger.kernel.org, jmorris@namei.org, ebiederm@xmission.com,
	eparis@parisplace.org, akpm@linux-foundation.org,
	adobriyan@gmail.com
Subject: Re: networking probs in next-20081203
Date: Thu, 04 Dec 2008 14:32:21 -0500	[thread overview]
Message-ID: <1228419142.11091.90.camel@moss-spartans.epoch.ncsc.mil> (raw)
In-Reply-To: <20081204.102138.123959105.davem@davemloft.net>

On Thu, 2008-12-04 at 10:21 -0800, David Miller wrote:
> From: Stephen Smalley <sds@tycho.nsa.gov>
> Date: Thu, 04 Dec 2008 13:11:20 -0500
> 
> > On Thu, 2008-12-04 at 20:52 +0300, Alexey Dobriyan wrote:
> > > On Thu, Dec 04, 2008 at 09:41:24AM -0800, Kok, Auke wrote:
> > > > maybe try disabling selinux?
> > > 
> > > This will work. :^)
> > 
> > SELinux didn't change here.  /proc/net did.
> 
> We've been through this before...

Yep, and we altered SELinux so that they could freely change proc
directories into symlinks to support the earlier proc/net change.  But
now proc/net has turned into its own separate filesystem, with its own
filesystem type, which is unknown to SELinux.  Thus causing it to be
left unlabeled and inaccessible to confined domains.

> And it is a usability issue that people can't change how procfs
> directories work without requiring the user to update their selinux
> policies first.

Introducing a new filesystem type (proc/net) without teaching SELinux
how to handle it is always going to produce denials on accessing that
filesystem.  If they left the filesystem type string as "proc" it
wouldn't be a problem.  Or they can adjust the SELinux code to
automagically handle it.  Regardless, we didn't break anything.

-- 
Stephen Smalley
National Security Agency


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/

  reply	other threads:[~2008-12-04 19:32 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-12-04  1:18 networking probs in next-20081203 Andrew Morton
2008-12-04 15:14 ` Alexey Dobriyan
2008-12-04 17:41   ` Kok, Auke
2008-12-04 17:52     ` Alexey Dobriyan
2008-12-04 18:11       ` [E1000-devel] " Stephen Smalley
2008-12-04 18:21         ` David Miller
2008-12-04 19:32           ` Stephen Smalley [this message]
2008-12-04 20:06             ` Stephen Smalley
2008-12-04 21:00               ` [E1000-devel] " Eric W. Biederman
2008-12-05  2:03                 ` James Morris
2008-12-05  7:49                   ` Eric W. Biederman
2008-12-05 14:12                 ` Stephen Smalley
2008-12-11 10:41                   ` James Morris
2008-12-12  5:24                     ` Alexey Dobriyan
2008-12-12  9:26                       ` James Morris
2008-12-12  9:29                         ` James Morris
2008-12-12 10:51                           ` Eric W. Biederman
2008-12-12 21:40                             ` [E1000-devel] " James Morris
2008-12-12 21:24                         ` Stephen Smalley
2008-12-15 13:28                           ` James Morris
2008-12-19  1:04                             ` [PATCH 0/3][RFC] Fix security and SELinux handling of proc/* filesystems James Morris
2008-12-19  1:05                               ` [PATCH 1/3][RFC] SELinux: correctly detect proc filesystems of the form "proc/foo" James Morris
2008-12-19 12:29                                 ` David P. Quigley
2008-12-19  1:06                               ` [PATCH 2/3][RFC] security: pass mount flags to security_sb_kern_mount() James Morris
2008-12-19 12:52                                 ` Stephen Smalley
2008-12-19  1:07                               ` [PATCH 3/3][RFC] SELinux: don't check permissions for kernel mounts James Morris
2008-12-19 12:52                                 ` Stephen Smalley
2008-12-19  6:40                               ` [PATCH 0/3][RFC] Fix security and SELinux handling of proc/* filesystems David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1228419142.11091.90.camel@moss-spartans.epoch.ncsc.mil \
    --to=sds@tycho.nsa.gov \
    --cc=adobriyan@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=auke-jan.h.kok@intel.com \
    --cc=davem@davemloft.net \
    --cc=e1000-devel@lists.sourceforge.net \
    --cc=ebiederm@xmission.com \
    --cc=eparis@parisplace.org \
    --cc=jmorris@namei.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.