Re: specifying groups of types

[David Caplan <dac@tresys.com>]

I didn't receive any comments on it.  I'd emphasize again that my 
solution was not a "proper" fix (it leaves open too many 
inconsistencies) and was not intended to be accepted as an official 
patch until it was cleaned up.  If no one comes up with a clean solution 
I'll fix mine when I have the chance.  Right now I'm trying to finish up 
the parsing code for our conditional policy modification among other things.

David

Chris PeBenito wrote:
> Was there any resolution to this?  I think this would be useful for
> checkpolicy to have, but it hasn't been merged (at least on the
> sourceforge cvs).  I don't remember seeing any official response from
> the NSA team about it nor any criticism/improvements of it.
> 
> On Tue, 2003-10-14 at 13:56, David Caplan wrote:
> 
>>Russell,
>>
>>Here's a quick hack that appears to work.  It turns off the type (or 
>>list of types if used on an attribute) when building the bitmap of types 
>>for a rule.  The syntax is to use a '-' in front of a type or attribute 
>>name.
>>
>>allow some_domain { file_type -shadow_t -null_device_t -exec_type}:...
>>
>>The proper way to do this is in the yacc parsing section.  All I did was 
>>allow '-' as the first character of an identifier (policy_scan.l) and 
>>handle the subtraction of the type/attribute in 
>>policy_parse.y:set_types().  The danger is that types (and anything 
>>using the identifier definition) can be declared with '-' as the first 
>>character and cause problems.  The advantage, in theory, is that 
>>wherever a list of types/attributes is processed, the '-' notation can 
>>be used to turn off types.  So, you should also be able to do something 
>>like:
>>
>>allow { auth -crond_t } file_type:...
>>
>>Types/attributes are processed in order, and subsequent allow rules can 
>>also override the subtraction.
>>
>>I'd recommend trying this out and if you find it useful change the parse 
>>rules.  I tested it on some real basic policy, so it may cause other 
>>unintended problems.  I'm throwing it out more as a starting point 
>>rather than something intended to be integrated into checkpolicy.
>>
>>David
>>
>>Stephen Smalley wrote:
>>
>>>On Sat, 2003-10-11 at 00:35, Russell Coker wrote:
>>>
>>>
>>>>Following a discussion on IRC, it occurs to me that it would be handy to have 
>>>>the following in the policy language:
>>>>allow some_domain { file_type !shadow_t }:...
>>>>
>>>>So we can specify everything in file_type except for shadow_t.
>>>
>>>
>>>Yes, although I'm not sure about the notation; might be better to
>>>provide a set difference operator, e.g.
>>>	file_type - shadow_t
>>>
>>>Are you offering to implement this enhancement to checkpolicy?
>>>


-- 
__________________________________

David Caplan     410 290 1411 x105
dac@tresys.com
Tresys Technology, LLC
8840 Stanford Blvd., Suite 2100
Columbia, MD 21045


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.