Re: MCS and default labels

[Michal Svoboda <michal.svoboda@agents.felk.cvut.cz>]

[-- Attachment #1: Type: text/plain, Size: 1527 bytes --]

Stephen Smalley wrote:
> I don't think so - the problem with selinuxfs tunables is that they
> can't be changed atomically with a policy change, and this is a property
> that should be tied to a particular policy.  For the same reason,
> properties like handle_unknown and permissive domains are defined in the
> policy itself rather than being selinuxfs tunables.

There have been things like compat_net, why can't the inheritance be
done on the same basis and must be part of the policy instead?

Anyway, I've been looking at the policy loader code, and it seems that
the easiest way to incorporate this into the policy would be to blend it
with the config field (which is presently used for MLS and
handle_unknown flags), perhaps by defining a flag like CATEGORY_INHERIT
and to check for it right after ALLOW_UNKNOWN and REJECT_UNKNOWN are
processed. This flag would then go to struct policydb and would be
checked for in the mls_compute_sid function (I can see direct usage of
the policydb global variable in that very function, so I guess it
shouldn't be a problem).

Perhaps there could also be an upgrade of the policy version number and
a check for the policy being loaded just to prevent random values being
present in that bit.

There would also need to be a change in libsepol and checkpolicy to
reflect this; perhaps checkpolicy could accept an additional command
line argument (as it does with handle_unknown), and a new field defined
in libsepol's policydb_t and further processed in its write.c.

Michal Svoboda

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]