From: russell@coker.com.au (Russell Coker)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] Chrome patch for discussion
Date: Sun, 17 Sep 2017 15:16:30 +1000 [thread overview]
Message-ID: <48575314.ulVpVAA9Qd@russell.coker.com.au> (raw)
In-Reply-To: <20170917041812.GA29152@meriadoc.perfinion.com>
On Sunday, 17 September 2017 12:18:12 PM AEST Jason Zaman wrote:
> We've had a chromium_t in gentoo for quite a while
>
> https://gitweb.gentoo.org/proj/hardened-refpolicy.git/tree/policy/modules/co
> ntrib/chromium.te
> https://gitweb.gentoo.org/proj/hardened-refpolicy.git/tree/policy/modules/c
> ontrib/chromium.if
> https://gitweb.gentoo.org/proj/hardened-refpolicy.git/tree/policy/modules/c
> ontrib/chromium.fc
>
> I kinda like firefox and chromium separate cuz chrome has a bunch of
> booleans for chromecast and fido u2f and stuff so then less perms can be
> given to FF.
>
> Also other stuff is that FF can work without execmem if you build with
> JIT disabled but chrome wont.
Those are good reasons for separating the domains.
> If we're separating the domains then we can just use the gentoo one
> instead of having to re-write. I can send it upstream if its good.
> Any comments on it?
Your policy is more comprehensive than mine.
How does that chromium_renderer_t work? Is that a standard chrome feature or
something special you did? It would probably be best to have a comment in the
policy about this.
It seems that the only difference between chromium_xdg_config_t and
chromium_xdg_cache_t is that the latter can't be read by chromium_renderer_t.
Is that sufficient reason to have an extra type?
Apart from that it appears ok to me. NB I haven't run it, I've just inspected
it.
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
next prev parent reply other threads:[~2017-09-17 5:16 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-17 3:28 [refpolicy] Chrome patch for discussion Russell Coker
2017-09-17 4:18 ` Jason Zaman
2017-09-17 5:16 ` Russell Coker [this message]
2017-09-19 2:55 ` Jason Zaman
2017-09-17 14:14 ` Chris PeBenito
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=48575314.ulVpVAA9Qd@russell.coker.com.au \
--to=russell@coker.com.au \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.