* [refpolicy] dbus/lvm read domain state @ 2009-03-15 16:09 Martin Orr 2009-03-15 23:23 ` Russell Coker 0 siblings, 1 reply; 3+ messages in thread From: Martin Orr @ 2009-03-15 16:09 UTC (permalink / raw) To: Christopher J. PeBenito; +Cc: SELinux List Both dbus and lvm want to read other processes' command lines. In the case of dbus, this is for use in log messages, which is probably useful. In the case of lvm, it is just to print in a warning if the parent process leaks fds to it, which I doubt is important enough to allow. Index: policy/modules/services/dbus.te =================================================================== --- policy/modules/services/dbus.te.orig +++ policy/modules/services/dbus.te @@ -94,6 +94,7 @@ corecmd_read_bin_sockets(system_dbusd_t) corecmd_exec_bin(system_dbusd_t) +domain_read_all_domains_state(system_dbusd_t) domain_use_interactive_fds(system_dbusd_t) files_read_etc_files(system_dbusd_t) Index: policy/modules/system/lvm.te =================================================================== --- policy/modules/system/lvm.te.orig +++ policy/modules/system/lvm.te @@ -243,6 +243,7 @@ corecmd_exec_bin(lvm_t) corecmd_exec_shell(lvm_t) +domain_dontaudit_read_all_domains_state(lvm_t) domain_use_interactive_fds(lvm_t) files_read_etc_files(lvm_t) -- Martin Orr -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [refpolicy] dbus/lvm read domain state 2009-03-15 16:09 [refpolicy] dbus/lvm read domain state Martin Orr @ 2009-03-15 23:23 ` Russell Coker 2009-03-31 14:51 ` Martin Orr 0 siblings, 1 reply; 3+ messages in thread From: Russell Coker @ 2009-03-15 23:23 UTC (permalink / raw) To: Martin Orr; +Cc: Christopher J. PeBenito, SELinux List On Mon, 16 Mar 2009, Martin Orr <martin@martinorr.name> wrote: > +domain_read_all_domains_state(system_dbusd_t) Do we really want all domains? I think it will do to allow system_dbusd_t to read all domains that talk to it. Why not modify dbus_system_bus_client() to have something like the following? allow system_dbusd_t $2:dir search; allow system_dbusd_t $2:file read_file_perms; -- russell@coker.com.au http://etbe.coker.com.au/ My Main Blog http://doc.coker.com.au/ My Documents Blog -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. ^ permalink raw reply [flat|nested] 3+ messages in thread
* [refpolicy] dbus/lvm read domain state 2009-03-15 23:23 ` Russell Coker @ 2009-03-31 14:51 ` Martin Orr 0 siblings, 0 replies; 3+ messages in thread From: Martin Orr @ 2009-03-31 14:51 UTC (permalink / raw) To: refpolicy On 15/03/09 23:23, Russell Coker wrote: > On Mon, 16 Mar 2009, Martin Orr <martin@martinorr.name> wrote: >> +domain_read_all_domains_state(system_dbusd_t) > > Do we really want all domains? I think it will do to allow system_dbusd_t to > read all domains that talk to it. > > Why not modify dbus_system_bus_client() to have something like the following? > allow system_dbusd_t $2:dir search; > allow system_dbusd_t $2:file read_file_perms; > Yes, that makes sense. I have added it to dbus_session_bus_client as well, and to dbus_system_bus_unconfined for unconfined_t (not sure about the last one - maybe unconfined_domain should call dbus_system_bus_client instead). Also, I have a vague idea that I'm not supposed to use $1 as the object type in an interface, and should use an attribute instead. Not sure where I got that idea from; Chris, could you confirm? Index: policy/modules/system/lvm.te =================================================================== --- policy/modules/system/lvm.te.orig +++ policy/modules/system/lvm.te @@ -243,6 +243,7 @@ corecmd_exec_bin(lvm_t) corecmd_exec_shell(lvm_t) +domain_dontaudit_read_all_domains_state(lvm_t) domain_use_interactive_fds(lvm_t) files_read_etc_files(lvm_t) Index: policy/modules/services/dbus.if =================================================================== --- policy/modules/services/dbus.if.orig +++ policy/modules/services/dbus.if @@ -197,6 +197,9 @@ files_search_pids($1) stream_connect_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t, system_dbusd_t) dbus_read_config($1) + + # DBus reads /proc/$pid/cmdline for logging + read_files_pattern(system_dbusd_t, $1, $1) ') ####################################### @@ -221,6 +224,9 @@ # For connecting to the bus allow $1 session_bus_type:unix_stream_socket connectto; + + # DBus reads /proc/$pid/cmdline for logging + read_files_pattern(session_bus_type, $1, $1) ') ######################################## @@ -317,4 +323,7 @@ ') allow $1 system_dbusd_t:dbus *; + + # DBus reads /proc/$pid/cmdline for logging + read_files_pattern(system_dbusd_t, $1, $1) ') -- Martin Orr ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2009-03-31 14:51 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2009-03-15 16:09 [refpolicy] dbus/lvm read domain state Martin Orr 2009-03-15 23:23 ` Russell Coker 2009-03-31 14:51 ` Martin Orr
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.