From: Chris PeBenito <pebenito@ieee.org>
To: Russell Coker <russell@coker.com.au>,
Dominick Grift <dominick.grift@defensec.nl>
Cc: selinux-refpolicy@vger.kernel.org
Subject: Re: another memlockd patch
Date: Tue, 14 Apr 2020 11:04:46 -0400 [thread overview]
Message-ID: <62d460c9-c538-7abd-aa7e-822ea9d22139@ieee.org> (raw)
In-Reply-To: <1765247.TeHuJhGoBa@liv>
On 4/10/20 5:40 AM, Russell Coker wrote:
> On Friday, 10 April 2020 6:10:57 PM AEST Dominick Grift wrote:
>>> +allow memlockd_t self:unix_dgram_socket { create connect };
>>
>> the unix dgram socket creating is probably redundant and implied with
>> logging_send_logs_msg() as journald uses dgram_sendto for logging?
>
> You are correct, that is redundant. Chris shall I submit the patch again or
> would it be easier to just delete that line when you merge?
Please resubmit with below change too.
>>> +# cache /etc/shadow too
>>> +auth_read_shadow(memlockd_t)
>>
>> Hmm since /etc/shadow is mode 000, how is memlock able to read this
>> without cap_dac_read_search access. is that implied?
>
> /etc/shadow is mode 640 on Debian.
>
> On other distributions the choice is either more permissions for memlockd or a
> configuration that doesn't cache /etc/shadow.
Seems that we need an ifndef(`distro_debian' block with dac_read_search;
--
Chris PeBenito
prev parent reply other threads:[~2020-04-14 15:16 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-10 6:03 another memlockd patch Russell Coker
2020-04-10 8:10 ` Dominick Grift
2020-04-10 9:40 ` Russell Coker
2020-04-14 15:04 ` Chris PeBenito [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=62d460c9-c538-7abd-aa7e-822ea9d22139@ieee.org \
--to=pebenito@ieee.org \
--cc=dominick.grift@defensec.nl \
--cc=russell@coker.com.au \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.