Re: Latest Diffs

[Russell Coker <russell@coker.com.au>]

On Wednesday 15 November 2006 07:11, Daniel J Walsh <dwalsh@redhat.com> wrote:
> >> Redhat's Fedora Extras apd-get and apt-shell run as rpm.
> >
> > Can't add this because it causes conflicting file contexts if the dpkg
> > module is included.
>
> I think we need a rewrite of the dpkg te file so on redhat platforms
> dbkg_t is aliased to rpm_t.

I think it's best if Red Hat compiles just don't include dpkg.te.

Have apt-get and yum run in the same context in Fedora.

> >> squid wants to rw_tmpfs for diskd mode.
> >
> > I'm wondering if this is tmpfs_t because there is no squid_tmpfs_t+type
> > transition, or if it is because the machine is targeted.
>
> Not sure, this was in the old policy as well.  Never used squid.

I believe that it was a mistake in the Squid policy.

> Added boolean to allow daemons to dump core in /.

Some of the fun things this permits include:

Creating a file named /fsckoptions with "-r" or "-N" as the contents (system 
hang on boot or failure to ever do an automatic fsck).

Creating /.unconfigured (could be good for taking over an Internet terminal 
machine).

Also as daemons don't have separate types for the core files there is the 
issue of matching the core files up to the domain that generated them.

Can't you use /proc/sys/kernel/core_pattern to put the core files somewhere 
else?  Preferably somewhere in a mode 700 directory.

Also those files that are generated in the root directory are a bad idea, 
there should probably be a long term plan to move them elsewhere.

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.