[refpolicy] [PATCH 2/2] system/modutils: Allow kmod to use the sys_admin cap

[guido@trentalancia.net (Guido Trentalancia)]

On Sun, 28/11/2016 at 23.03 +0100, Luis Ressel wrote:
> On Mon, 28 Nov 2016 18:02:56 +0100
> Guido Trentalancia via refpolicy <refpolicy@oss.tresys.com> wrote:

[...]

> I do of course agree that unconditionally adding grsec-specific
> permissions to the refpolicy isn't optimal either.
> 
> What are your thoughts about adding a new kernel_grsec ifdef, similar
> to our current distro_* ifdef's? It would apply to the getty_t
> permission I mentioned earlier, to the kmod_t capability discussed in
> this thread (as soon as we've confirmed it is indeed grsec-related),
> and to any other grsec-specific permissions we've added in the past
> (@Sven, Jason: Do you remember any such permissions?).

Yes, that's the way forward.

> The vast majority of refpolicy+grsec users are probably gentoo folks,
> so we could keep these permissions in ifdef(distro_gentoo) blocks,
> too;

Enclosing them in double ifdef should not be necessary. In my opinion,
the former proposal is enough (ifdef grsecurity).

> but I think that wouldn't be ideal. After all, there may well be
> other
> people using this particular combination; it's not gentoo-specific.

I really look forward to seeing the optimized patches !

Regards,

Guido