* [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd
@ 2012-09-13 14:08 Stephen Smalley
2012-09-13 15:27 ` Daniel J Walsh
0 siblings, 1 reply; 11+ messages in thread
From: Stephen Smalley @ 2012-09-13 14:08 UTC (permalink / raw)
To: Serge Hallyn; +Cc: selinux, Eric Paris
Several test cases require the ability to read /etc/passwd to look
up usernames. Recent Fedora introduced a separate type on /etc/passwd
and therefore we need to add an interface call to test_global.te. Fixes
three test failures on Fedora 17.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
policy/test_global.te | 2 ++
1 file changed, 2 insertions(+)
diff --git a/policy/test_global.te b/policy/test_global.te
index 77121ae..fdfd291 100644
--- a/policy/test_global.te
+++ b/policy/test_global.te
@@ -88,3 +88,5 @@ selinux_compute_access_vector(testdomain)
selinux_compute_create_context(testdomain)
selinux_compute_relabel_context(testdomain)
selinux_compute_user_contexts(testdomain)
+
+auth_read_passwd(testdomain)
--
1.7.11.4
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd
2012-09-13 14:08 [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd Stephen Smalley
@ 2012-09-13 15:27 ` Daniel J Walsh
2012-09-14 18:29 ` [refpolicy] " Sven Vermeulen
2012-09-15 2:22 ` Serge E. Hallyn
0 siblings, 2 replies; 11+ messages in thread
From: Daniel J Walsh @ 2012-09-13 15:27 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Serge Hallyn, selinux, Eric Paris
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/13/2012 10:08 AM, Stephen Smalley wrote:
> Several test cases require the ability to read /etc/passwd to look up
> usernames. Recent Fedora introduced a separate type on /etc/passwd and
> therefore we need to add an interface call to test_global.te. Fixes three
> test failures on Fedora 17.
>
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> ---
> policy/test_global.te | 2 ++ 1 file changed, 2 insertions(+)
>
> diff --git a/policy/test_global.te b/policy/test_global.te index
> 77121ae..fdfd291 100644 --- a/policy/test_global.te +++
> b/policy/test_global.te @@ -88,3 +88,5 @@
> selinux_compute_access_vector(testdomain)
> selinux_compute_create_context(testdomain)
> selinux_compute_relabel_context(testdomain)
> selinux_compute_user_contexts(testdomain) + +auth_read_passwd(testdomain)
>
Probably should use
auth_use_nsswitch(testdomain)
Since this will handle cases where users are listed in ldap or use sssd.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBR+2oACgkQrlYvE4MpobMW4wCfatkbYxWYNhJCWH96YUS8frm8
kwMAoJrC6pS6YOFQcYlNFtqE07hFn6ia
=NZ1T
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* [refpolicy] [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd
2012-09-13 15:27 ` Daniel J Walsh
@ 2012-09-14 18:29 ` Sven Vermeulen
2012-09-15 2:22 ` Serge E. Hallyn
1 sibling, 0 replies; 11+ messages in thread
From: Sven Vermeulen @ 2012-09-14 18:29 UTC (permalink / raw)
To: refpolicy
On Sep 13, 2012 5:40 PM, "Daniel J Walsh" <dwalsh@redhat.com> wrote:
> > selinux_compute_create_context(testdomain)
> > selinux_compute_relabel_context(testdomain)
> > selinux_compute_user_contexts(testdomain) +
+auth_read_passwd(testdomain)
> >
> Probably should use
>
> auth_use_nsswitch(testdomain)
>
> Since this will handle cases where users are listed in ldap or use sssd.
Also please try to not depend on distribution policies but rather
refpolicy. Other distributions don't use a separate type for passwd (yet?)
and I don't know if the interface suggested before is also supported.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20120914/cfc0a1d8/attachment.html
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd
2012-09-13 15:27 ` Daniel J Walsh
2012-09-14 18:29 ` [refpolicy] " Sven Vermeulen
@ 2012-09-15 2:22 ` Serge E. Hallyn
2012-09-18 13:45 ` Stephen Smalley
1 sibling, 1 reply; 11+ messages in thread
From: Serge E. Hallyn @ 2012-09-15 2:22 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, Serge Hallyn, selinux, Eric Paris
Quoting Daniel J Walsh (dwalsh@redhat.com):
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 09/13/2012 10:08 AM, Stephen Smalley wrote:
> > Several test cases require the ability to read /etc/passwd to look up
> > usernames. Recent Fedora introduced a separate type on /etc/passwd and
> > therefore we need to add an interface call to test_global.te. Fixes three
> > test failures on Fedora 17.
> >
> > Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> ---
> > policy/test_global.te | 2 ++ 1 file changed, 2 insertions(+)
> >
> > diff --git a/policy/test_global.te b/policy/test_global.te index
> > 77121ae..fdfd291 100644 --- a/policy/test_global.te +++
> > b/policy/test_global.te @@ -88,3 +88,5 @@
> > selinux_compute_access_vector(testdomain)
> > selinux_compute_create_context(testdomain)
> > selinux_compute_relabel_context(testdomain)
> > selinux_compute_user_contexts(testdomain) + +auth_read_passwd(testdomain)
> >
> Probably should use
>
> auth_use_nsswitch(testdomain)
>
> Since this will handle cases where users are listed in ldap or use sssd.
Stephen, would you like that instead?
thanks,
-serge
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd
2012-09-15 2:22 ` Serge E. Hallyn
@ 2012-09-18 13:45 ` Stephen Smalley
2012-09-18 16:32 ` Daniel J Walsh
0 siblings, 1 reply; 11+ messages in thread
From: Stephen Smalley @ 2012-09-18 13:45 UTC (permalink / raw)
To: Serge E. Hallyn; +Cc: Daniel J Walsh, selinux, Eric Paris
On Sat, 2012-09-15 at 02:22 +0000, Serge E. Hallyn wrote:
> Quoting Daniel J Walsh (dwalsh@redhat.com):
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On 09/13/2012 10:08 AM, Stephen Smalley wrote:
> > > Several test cases require the ability to read /etc/passwd to look up
> > > usernames. Recent Fedora introduced a separate type on /etc/passwd and
> > > therefore we need to add an interface call to test_global.te. Fixes three
> > > test failures on Fedora 17.
> > >
> > > Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> ---
> > > policy/test_global.te | 2 ++ 1 file changed, 2 insertions(+)
> > >
> > > diff --git a/policy/test_global.te b/policy/test_global.te index
> > > 77121ae..fdfd291 100644 --- a/policy/test_global.te +++
> > > b/policy/test_global.te @@ -88,3 +88,5 @@
> > > selinux_compute_access_vector(testdomain)
> > > selinux_compute_create_context(testdomain)
> > > selinux_compute_relabel_context(testdomain)
> > > selinux_compute_user_contexts(testdomain) + +auth_read_passwd(testdomain)
> > >
> > Probably should use
> >
> > auth_use_nsswitch(testdomain)
> >
> > Since this will handle cases where users are listed in ldap or use sssd.
>
> Stephen, would you like that instead?
No, it doesn't work - you cannot pass an attribute name to that
interface.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd
2012-09-18 13:45 ` Stephen Smalley
@ 2012-09-18 16:32 ` Daniel J Walsh
2012-09-18 17:20 ` Stephen Smalley
0 siblings, 1 reply; 11+ messages in thread
From: Daniel J Walsh @ 2012-09-18 16:32 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Serge E. Hallyn, selinux, Eric Paris
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/18/2012 09:45 AM, Stephen Smalley wrote:
> On Sat, 2012-09-15 at 02:22 +0000, Serge E. Hallyn wrote:
>> Quoting Daniel J Walsh (dwalsh@redhat.com):
>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>>
>>> On 09/13/2012 10:08 AM, Stephen Smalley wrote:
>>>> Several test cases require the ability to read /etc/passwd to look
>>>> up usernames. Recent Fedora introduced a separate type on
>>>> /etc/passwd and therefore we need to add an interface call to
>>>> test_global.te. Fixes three test failures on Fedora 17.
>>>>
>>>> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> ---
>>>> policy/test_global.te | 2 ++ 1 file changed, 2 insertions(+)
>>>>
>>>> diff --git a/policy/test_global.te b/policy/test_global.te index
>>>> 77121ae..fdfd291 100644 --- a/policy/test_global.te +++
>>>> b/policy/test_global.te @@ -88,3 +88,5 @@
>>>> selinux_compute_access_vector(testdomain)
>>>> selinux_compute_create_context(testdomain)
>>>> selinux_compute_relabel_context(testdomain)
>>>> selinux_compute_user_contexts(testdomain) +
>>>> +auth_read_passwd(testdomain)
>>>>
>>> Probably should use
>>>
>>> auth_use_nsswitch(testdomain)
>>>
>>> Since this will handle cases where users are listed in ldap or use
>>> sssd.
>>
>> Stephen, would you like that instead?
>
> No, it doesn't work - you cannot pass an attribute name to that interface.
>
Ahh yes, you can not assign an attribute to an attribute. That is right up
there with no assigning an attribute within a boolean as my least liked things
about our policy compiler.
I guess you need to add auth_use_nsswitch() for each type that gets set to
test_domain.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBYoi4ACgkQrlYvE4MpobP60wCgl/6UDWf0MSTnjfr1psB6DsvB
hdIAoImqV09iWasmP1hnuNAiOl0Mf8O4
=lf6L
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd
2012-09-18 16:32 ` Daniel J Walsh
@ 2012-09-18 17:20 ` Stephen Smalley
2012-09-20 16:31 ` Serge E. Hallyn
0 siblings, 1 reply; 11+ messages in thread
From: Stephen Smalley @ 2012-09-18 17:20 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Serge E. Hallyn, selinux, Eric Paris
On Tue, 2012-09-18 at 12:32 -0400, Daniel J Walsh wrote:
> On 09/18/2012 09:45 AM, Stephen Smalley wrote:
> > On Sat, 2012-09-15 at 02:22 +0000, Serge E. Hallyn wrote:
> >> Quoting Daniel J Walsh (dwalsh@redhat.com):
> >>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
> >>>
> >>> On 09/13/2012 10:08 AM, Stephen Smalley wrote:
> >>>> Several test cases require the ability to read /etc/passwd to look
> >>>> up usernames. Recent Fedora introduced a separate type on
> >>>> /etc/passwd and therefore we need to add an interface call to
> >>>> test_global.te. Fixes three test failures on Fedora 17.
> >>>>
> >>>> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> ---
> >>>> policy/test_global.te | 2 ++ 1 file changed, 2 insertions(+)
> >>>>
> >>>> diff --git a/policy/test_global.te b/policy/test_global.te index
> >>>> 77121ae..fdfd291 100644 --- a/policy/test_global.te +++
> >>>> b/policy/test_global.te @@ -88,3 +88,5 @@
> >>>> selinux_compute_access_vector(testdomain)
> >>>> selinux_compute_create_context(testdomain)
> >>>> selinux_compute_relabel_context(testdomain)
> >>>> selinux_compute_user_contexts(testdomain) +
> >>>> +auth_read_passwd(testdomain)
> >>>>
> >>> Probably should use
> >>>
> >>> auth_use_nsswitch(testdomain)
> >>>
> >>> Since this will handle cases where users are listed in ldap or use
> >>> sssd.
> >>
> >> Stephen, would you like that instead?
> >
> > No, it doesn't work - you cannot pass an attribute name to that interface.
> >
>
> Ahh yes, you can not assign an attribute to an attribute. That is right up
> there with no assigning an attribute within a boolean as my least liked things
> about our policy compiler.
>
>
> I guess you need to add auth_use_nsswitch() for each type that gets set to
> test_domain.
That would be rather painful. For now, let's just use
auth_read_passwd(testdomain). Works for me.
auth_use_nsswitch() might have undesirable side effects, like allowing
every test domain network access. Which would then prevent testing
enforcement of the socket permission checks.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd
2012-09-18 17:20 ` Stephen Smalley
@ 2012-09-20 16:31 ` Serge E. Hallyn
2012-09-21 8:46 ` Sven Vermeulen
0 siblings, 1 reply; 11+ messages in thread
From: Serge E. Hallyn @ 2012-09-20 16:31 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Daniel J Walsh, Serge E. Hallyn, selinux, Eric Paris
Thanks, applied.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd
2012-09-20 16:31 ` Serge E. Hallyn
@ 2012-09-21 8:46 ` Sven Vermeulen
2012-09-21 13:50 ` [PATCH] selinux-testsuite: Wrap auth_read_passwd with ifdef(`distro_redhat') Stephen Smalley
0 siblings, 1 reply; 11+ messages in thread
From: Sven Vermeulen @ 2012-09-21 8:46 UTC (permalink / raw)
To: SELinux
[-- Attachment #1: Type: text/plain, Size: 261 bytes --]
On Sep 20, 2012 6:34 PM, "Serge E. Hallyn" <serge@hallyn.com> wrote:
> Thanks, applied.
Can we please get auth_read_passwd defined in refpolicy then? If anything,
have it grant read access to etc_t. Otherwise tests in other distributions
but fedora will fail.
[-- Attachment #2: Type: text/html, Size: 345 bytes --]
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH] selinux-testsuite: Wrap auth_read_passwd with ifdef(`distro_redhat') .
2012-09-21 8:46 ` Sven Vermeulen
@ 2012-09-21 13:50 ` Stephen Smalley
2012-09-25 16:47 ` Serge E. Hallyn
0 siblings, 1 reply; 11+ messages in thread
From: Stephen Smalley @ 2012-09-21 13:50 UTC (permalink / raw)
To: Sven Vermeulen; +Cc: SELinux, Serge Hallyn
Wrap Fedora-specific policy with an ifdef. Alternative would be to fork
a copy of the test policy per distro under policy/<distro>/<release> as
we have already done for redhat 4 and 5.
But I'd prefer to only do that for long-term stable/enterprise releases
that won't be changing very often.
---
policy/test_global.te | 2 ++
1 file changed, 2 insertions(+)
diff --git a/policy/test_global.te b/policy/test_global.te
index fdfd291..b92cc1c 100644
--- a/policy/test_global.te
+++ b/policy/test_global.te
@@ -89,4 +89,6 @@ selinux_compute_create_context(testdomain)
selinux_compute_relabel_context(testdomain)
selinux_compute_user_contexts(testdomain)
+ifdef(`distro_redhat', `
auth_read_passwd(testdomain)
+')
--
1.7.11.4
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH] selinux-testsuite: Wrap auth_read_passwd with ifdef(`distro_redhat') .
2012-09-21 13:50 ` [PATCH] selinux-testsuite: Wrap auth_read_passwd with ifdef(`distro_redhat') Stephen Smalley
@ 2012-09-25 16:47 ` Serge E. Hallyn
0 siblings, 0 replies; 11+ messages in thread
From: Serge E. Hallyn @ 2012-09-25 16:47 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Sven Vermeulen, SELinux, Serge Hallyn
Quoting Stephen Smalley (sds@tycho.nsa.gov):
>
> Wrap Fedora-specific policy with an ifdef. Alternative would be to fork
> a copy of the test policy per distro under policy/<distro>/<release> as
> we have already done for redhat 4 and 5.
> But I'd prefer to only do that for long-term stable/enterprise releases
> that won't be changing very often.
>
> ---
> policy/test_global.te | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/policy/test_global.te b/policy/test_global.te
> index fdfd291..b92cc1c 100644
> --- a/policy/test_global.te
> +++ b/policy/test_global.te
> @@ -89,4 +89,6 @@ selinux_compute_create_context(testdomain)
> selinux_compute_relabel_context(testdomain)
> selinux_compute_user_contexts(testdomain)
>
> +ifdef(`distro_redhat', `
> auth_read_passwd(testdomain)
> +')
> --
> 1.7.11.4
Applied, thanks.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2012-09-25 16:47 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-09-13 14:08 [PATCH] selinux-testsuite: Allow test domains to read /etc/passwd Stephen Smalley
2012-09-13 15:27 ` Daniel J Walsh
2012-09-14 18:29 ` [refpolicy] " Sven Vermeulen
2012-09-15 2:22 ` Serge E. Hallyn
2012-09-18 13:45 ` Stephen Smalley
2012-09-18 16:32 ` Daniel J Walsh
2012-09-18 17:20 ` Stephen Smalley
2012-09-20 16:31 ` Serge E. Hallyn
2012-09-21 8:46 ` Sven Vermeulen
2012-09-21 13:50 ` [PATCH] selinux-testsuite: Wrap auth_read_passwd with ifdef(`distro_redhat') Stephen Smalley
2012-09-25 16:47 ` Serge E. Hallyn
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.