All of lore.kernel.org
 help / color / mirror / Atom feed
From: Paul Moore <pmoore@redhat.com>
To: Guido Trentalancia <guido@trentalancia.net>
Cc: Paul Moore <paul@paul-moore.com>, selinux@tycho.nsa.gov
Subject: Re: [PATCH] Differentiate between Unix Stream Socket and Sequential Packet Socket
Date: Sat, 20 Aug 2016 14:44:45 -0400	[thread overview]
Message-ID: <CAGH-KguvJZVLAUYQP_iFk2KG7DDFe9kGADWK_dkbGPHuStjpcQ@mail.gmail.com> (raw)
In-Reply-To: <89E5C3EA-9794-4496-A195-1C997A5BBF44@trentalancia.net>

On Sat, Aug 20, 2016 at 1:39 PM, Guido Trentalancia
<guido@trentalancia.net> wrote:
> Hello Paul,
>
> thanks for getting back on this.
>
> The patch follows a recent discussion with Christopher PeBenito on the Reference Policy mailing list.

Which patch/thread (what was the subject line)?  I have seen a lot of
patches and discussion between you and Chris lately (thanks for your
contributions!) but I haven't followed them very closely.

> Christopher suggested to modify the actual code.
>
> I suppose it provides a better insight during code analysis on the type of socket connections being made and a more fine-grained control of permissions being granted or denied to the policy designer.

The only value I can see to this change would be if we needed to
differentiate between AF_UNIX stream and seqpacket connections, and to
be honest I don't see the difference being that important.  As I said
before, we need to understand what you are trying to solve and how it
is only possible with this change.  The unspecified problem you are
seeing below wont be resolved by this patch (as you already
mentioned).

> For some reason however, I have seen code using the SOCK_SEQPACKET type and executed immediately after policy load (possibly from initramfs, before switchroot) showing up in the log files as using an unspecified socket type. I have explained already to Christopher that this patch won't change such behavior...

Yes, that should be unrelated to this change.  Are you able to
reproduce the above problem reliably?

-- 
paul moore
security @ redhat

  reply	other threads:[~2016-08-20 18:44 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-08-20 16:18 [PATCH] Differentiate between Unix Stream Socket and Sequential Packet Socket Guido Trentalancia
2016-08-20 17:17 ` Paul Moore
2016-08-20 17:39   ` Guido Trentalancia
2016-08-20 18:44     ` Paul Moore [this message]
2016-08-20 19:09       ` Guido Trentalancia
2016-08-21  3:24         ` Paul Moore
2016-08-21 17:17           ` [PATCH v2] " Guido Trentalancia
2016-08-22 13:02             ` [PATCH v3] Classify AF_ALG sockets (was: Differentiate between Unix Stream Socket and Sequential Packet Socket) Guido Trentalancia
2016-08-22 20:17               ` Paul Moore
2016-08-22 21:07                 ` Guido Trentalancia
2016-08-22 21:04               ` [PATCH v4] Classify AF_ALG sockets Guido Trentalancia
2016-08-22 22:36                 ` Paul Moore
2016-08-23 13:05                   ` Stephen Smalley
2016-08-23 13:35                     ` Paul Moore
2016-08-23 14:14                 ` [PATCH v5] " Guido Trentalancia
2016-08-23 14:42                   ` Stephen Smalley
2016-08-23 15:21                     ` [PATCH] Update libsepol to support the policy capability for " Guido Trentalancia
2016-08-23 22:02                     ` [PATCH v5] Classify " Paul Moore
2016-08-23 23:03                       ` Guido Trentalancia
2016-08-21 17:31           ` [PATCH] Differentiate between Unix Stream Socket and Sequential Packet Socket Guido Trentalancia
2016-08-21 17:32           ` Guido Trentalancia

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAGH-KguvJZVLAUYQP_iFk2KG7DDFe9kGADWK_dkbGPHuStjpcQ@mail.gmail.com \
    --to=pmoore@redhat.com \
    --cc=guido@trentalancia.net \
    --cc=paul@paul-moore.com \
    --cc=selinux@tycho.nsa.gov \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.