[refpolicy] kernel_domain.patch

[refpolicy] kernel_domain.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F13/kernel_domain.patch

Lots of changes to domain.  Mainly around leaks....

[refpolicy] kernel_domain.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_domain.patch

Handle mmap_low correctly
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx27r0ACgkQrlYvE4MpobP0NgCfQk3QcLlGkrSvuMVrvYlgsCx2
1BcAn2g0LgbjzHc25wHQKTUOD0hRVBZE
=OKbC
-----END PGP SIGNATURE-----

[refpolicy] kernel_domain.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_domain.patch

Fix interface descriptions

Lots of new domains.

Added polydomain

[refpolicy] kernel_domain.patch

[Christopher J. PeBenito]

On Wed, 2010-06-02 at 16:20 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_domain.patch
> 
> Fix interface descriptions
> 
> Lots of new domains.
> 
> Added polydomain

What is the purpose of polydomain?

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] kernel_domain.patch

[Daniel J Walsh]

On 06/04/2010 09:39 AM, Christopher J. PeBenito wrote:
> On Wed, 2010-06-02 at 16:20 -0400, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_domain.patch
>>
>> Fix interface descriptions
>>
>> Lots of new domains.
>>
>> Added polydomain
>
> What is the purpose of polydomain?
>

If I have a polinstatiated homedir like on an MLS machine.  When login 
programs creates the homedir it needs to populate it with content from 
/etc/skel.  When it does this, it needs to relabel it to user homedir 
content.


tunable_policy(`allow_polyinstantiation',`
	files_polyinstantiate_all(polydomain)
	userdom_manage_user_home_content_dirs(polydomain)
	userdom_manage_user_home_content_files(polydomain)
	userdom_relabelto_user_home_dirs(polydomain)
	userdom_relabelto_user_home_files(polydomain)
'

[refpolicy] kernel_domain.patch

[Christopher J. PeBenito]

On Fri, 2010-06-04 at 09:52 -0400, Daniel J Walsh wrote:
> On 06/04/2010 09:39 AM, Christopher J. PeBenito wrote:
> > On Wed, 2010-06-02 at 16:20 -0400, Daniel J Walsh wrote:
> >> http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_domain.patch
> >>
> >> Fix interface descriptions
> >>
> >> Lots of new domains.
> >>
> >> Added polydomain
> >
> > What is the purpose of polydomain?
> >
> 
> If I have a polinstatiated homedir like on an MLS machine.  When login 
> programs creates the homedir it needs to populate it with content from 
> /etc/skel.  When it does this, it needs to relabel it to user homedir 
> content.

That sounds like rules in auth_login_pgm_domain() that should already
exist.

> tunable_policy(`allow_polyinstantiation',`
> 	files_polyinstantiate_all(polydomain)
> 	userdom_manage_user_home_content_dirs(polydomain)
> 	userdom_manage_user_home_content_files(polydomain)
> 	userdom_relabelto_user_home_dirs(polydomain)
> 	userdom_relabelto_user_home_files(polydomain)
> '

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] kernel_domain.patch

[Daniel J Walsh]

On 06/07/2010 08:51 AM, Christopher J. PeBenito wrote:
> On Fri, 2010-06-04 at 09:52 -0400, Daniel J Walsh wrote:
>> On 06/04/2010 09:39 AM, Christopher J. PeBenito wrote:
>>> On Wed, 2010-06-02 at 16:20 -0400, Daniel J Walsh wrote:
>>>> http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_domain.patch
>>>>
>>>> Fix interface descriptions
>>>>
>>>> Lots of new domains.
>>>>
>>>> Added polydomain
>>>
>>> What is the purpose of polydomain?
>>>
>>
>> If I have a polinstatiated homedir like on an MLS machine.  When login
>> programs creates the homedir it needs to populate it with content from
>> /etc/skel.  When it does this, it needs to relabel it to user homedir
>> content.
>
> That sounds like rules in auth_login_pgm_domain() that should already
> exist.
>
>> tunable_policy(`allow_polyinstantiation',`
>> 	files_polyinstantiate_all(polydomain)
>> 	userdom_manage_user_home_content_dirs(polydomain)
>> 	userdom_manage_user_home_content_files(polydomain)
>> 	userdom_relabelto_user_home_dirs(polydomain)
>> 	userdom_relabelto_user_home_files(polydomain)
>> '
>
The rules do not exist there currently other then 
files_polyinstantiate_all(polydomain)

We could move this there or eliminate it and use the attribute save 
hundreds/thousands of rules.

[refpolicy] kernel_domain.patch

[Christopher J. PeBenito]

On Mon, 2010-06-07 at 09:27 -0400, Daniel J Walsh wrote:
> On 06/07/2010 08:51 AM, Christopher J. PeBenito wrote:
> > On Fri, 2010-06-04 at 09:52 -0400, Daniel J Walsh wrote:
> >> On 06/04/2010 09:39 AM, Christopher J. PeBenito wrote:
> >>> On Wed, 2010-06-02 at 16:20 -0400, Daniel J Walsh wrote:
> >>>> http://people.fedoraproject.org/~dwalsh/SELinux/F14/kernel_domain.patch
> >>>>
> >>>> Fix interface descriptions
> >>>>
> >>>> Lots of new domains.
> >>>>
> >>>> Added polydomain
> >>>
> >>> What is the purpose of polydomain?
> >>>
> >>
> >> If I have a polinstatiated homedir like on an MLS machine.  When login
> >> programs creates the homedir it needs to populate it with content from
> >> /etc/skel.  When it does this, it needs to relabel it to user homedir
> >> content.
> >
> > That sounds like rules in auth_login_pgm_domain() that should already
> > exist.
> >
> >> tunable_policy(`allow_polyinstantiation',`
> >> 	files_polyinstantiate_all(polydomain)
> >> 	userdom_manage_user_home_content_dirs(polydomain)
> >> 	userdom_manage_user_home_content_files(polydomain)
> >> 	userdom_relabelto_user_home_dirs(polydomain)
> >> 	userdom_relabelto_user_home_files(polydomain)
> >> '
> >
> The rules do not exist there currently other then 
> files_polyinstantiate_all(polydomain)
> 
> We could move this there or eliminate it and use the attribute save 
> hundreds/thousands of rules.

I'd prefer it as part of the auth_login_pgm_domain(), since that is what
the concept is.  If you want to look at turning that interface into an
attribute with rules in authlogin.te then that would be fine.

If you're that concerned about the rule count, perhaps you could
convince Red Hat to invest some time in an optimizing policy
compiler? :)

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] kernel_domain.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/kernel_domain.patch

F12 domain 

moved a lot of stuff out to use an attribute

added a getsched interface 

And several other global interfaces

[refpolicy] kernel_domain.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_domain.patch

Add search_dir_perms to domain search

Add interface to define domain_mmap_low_type So I can have the attribute 
without the right.   Then I can write the allow rule with a boolean.

Add attribute polydomain which can turn on and off 
allow_polyinstatiation boolean.


Lots of global allows to prevent spurious avc messages.

[refpolicy] kernel_domain.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_domain.patch

Add interface domain_mmap_low and write it so it can be controled by boolean

Lots of stuff to stop random bogus avc's

Add polydomain interface to allow polyinstation boolean

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmu9EsACgkQrlYvE4MpobPuBACfa+EDtybTaaWaijAQKc1Q3N7E
D8cAoNcDiu1svMk18IJEHCzTqYn8b5iI
=vedN
-----END PGP SIGNATURE-----

[refpolicy] kernel_domain.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_domain.patch

Separate the type for domains that can mmap_zero from the actual ability
to set mmap_zero so we can use a boolean to set this ability.  If we
ever got the ability to have attributes surrounded by booleans, this
type of hacking would not be necessary.

Allow all unconfined_domains to set chat with all domains.

Allow unconfined domains to write to all domains proc files

A bunch of domain prevent dumb avcs

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkksdG8ACgkQrlYvE4MpobMawQCeMaHw+nTBbUlKv0mGaLg48kZ/
wroAoJjrbmP2GSI3cJ6iBf19fEBNKtP7
=zkYf
-----END PGP SIGNATURE-----