* [refpolicy] [PATCH] Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types.
@ 2012-08-29 17:59 Dominick Grift
2012-09-05 17:27 ` Christopher J. PeBenito
0 siblings, 1 reply; 4+ messages in thread
From: Dominick Grift @ 2012-08-29 17:59 UTC (permalink / raw)
To: refpolicy
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
index 6a1e4d1..9f82171 100644
--- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if
@@ -623,10 +623,7 @@
attribute domain;
')
- kernel_search_proc($1)
- allow $1 domain:dir list_dir_perms;
- read_files_pattern($1, domain, domain)
- read_lnk_files_pattern($1, domain, domain)
+ ps_process_pattern($1, domain)
')
########################################
@@ -683,10 +680,7 @@
attribute domain, unconfined_domain_type;
')
- kernel_search_proc($1)
- allow $1 { domain -unconfined_domain_type }:dir list_dir_perms;
- read_files_pattern($1, { domain -unconfined_domain_type }, { domain -unconfined_domain_type })
- read_lnk_files_pattern($1, { domain -unconfined_domain_type }, { domain -unconfined_domain_type })
+ ps_process_pattern($1, { domain -unconfined_domain_type })
dontaudit $1 unconfined_domain_type:dir search_dir_perms;
dontaudit $1 unconfined_domain_type:file read_file_perms;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [refpolicy] [PATCH] Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types.
2012-08-29 17:59 [refpolicy] [PATCH] Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types Dominick Grift
@ 2012-09-05 17:27 ` Christopher J. PeBenito
2012-09-05 17:45 ` Dominick Grift
0 siblings, 1 reply; 4+ messages in thread
From: Christopher J. PeBenito @ 2012-09-05 17:27 UTC (permalink / raw)
To: refpolicy
On 08/29/12 13:59, Dominick Grift wrote:
>
> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
> index 6a1e4d1..9f82171 100644
> --- a/policy/modules/kernel/domain.if
> +++ b/policy/modules/kernel/domain.if
> @@ -623,10 +623,7 @@
> attribute domain;
> ')
>
> - kernel_search_proc($1)
> - allow $1 domain:dir list_dir_perms;
> - read_files_pattern($1, domain, domain)
> - read_lnk_files_pattern($1, domain, domain)
> + ps_process_pattern($1, domain)
> ')
>
> ########################################
> @@ -683,10 +680,7 @@
> attribute domain, unconfined_domain_type;
> ')
>
> - kernel_search_proc($1)
> - allow $1 { domain -unconfined_domain_type }:dir list_dir_perms;
> - read_files_pattern($1, { domain -unconfined_domain_type }, { domain -unconfined_domain_type })
> - read_lnk_files_pattern($1, { domain -unconfined_domain_type }, { domain -unconfined_domain_type })
> + ps_process_pattern($1, { domain -unconfined_domain_type })
>
> dontaudit $1 unconfined_domain_type:dir search_dir_perms;
> dontaudit $1 unconfined_domain_type:file read_file_perms;
I'd have to say no to this patch. As you say, not all domains that read other domains' state needs to getattr the process.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 4+ messages in thread
* [refpolicy] [PATCH] Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types.
2012-09-05 17:27 ` Christopher J. PeBenito
@ 2012-09-05 17:45 ` Dominick Grift
2012-09-05 18:16 ` Christopher J. PeBenito
0 siblings, 1 reply; 4+ messages in thread
From: Dominick Grift @ 2012-09-05 17:45 UTC (permalink / raw)
To: refpolicy
On Wed, 2012-09-05 at 13:27 -0400, Christopher J. PeBenito wrote:
> I'd have to say no to this patch. As you say, not all domains that read other domains' state needs to getattr the process.
>
ok, but why is that problem big enough to not use the cleaner
ps_process_pattern. and why does the ps_process_pattern include the
getattr?
^ permalink raw reply [flat|nested] 4+ messages in thread
* [refpolicy] [PATCH] Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types.
2012-09-05 17:45 ` Dominick Grift
@ 2012-09-05 18:16 ` Christopher J. PeBenito
0 siblings, 0 replies; 4+ messages in thread
From: Christopher J. PeBenito @ 2012-09-05 18:16 UTC (permalink / raw)
To: refpolicy
On 09/05/12 13:45, Dominick Grift wrote:
> On Wed, 2012-09-05 at 13:27 -0400, Christopher J. PeBenito wrote:
>> I'd have to say no to this patch. As you say, not all domains that read other domains' state needs to getattr the process.
> ok, but why is that problem big enough to not use the cleaner
> ps_process_pattern. and why does the ps_process_pattern include the
> getattr?
It originated to support ps, including ps -Z.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-09-05 18:16 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-08-29 17:59 [refpolicy] [PATCH] Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types Dominick Grift
2012-09-05 17:27 ` Christopher J. PeBenito
2012-09-05 17:45 ` Dominick Grift
2012-09-05 18:16 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.