SELinux-Refpolicy Archive on lore.kernel.org
 help / color / Atom feed
From: Chris PeBenito <pebenito@ieee.org>
To: refpolicy <selinux-refpolicy@vger.kernel.org>
Subject: [RFC] refining systemd mountpoints
Date: Thu, 9 Jan 2020 16:06:38 -0500
Message-ID: <3418ebca-80c0-b10e-c0a2-a80427fdbf71@ieee.org> (raw)

I'd like to refine how the policy handles systemd's mounton so that it 
works similar to how we manage mountpoints for mount_t. Since systemd 
can be made to mount over just about anything, I'm looking at adding a 
new conditional that would allow init_t to mounton 
non_security_file_type, and then an interface like files_mountpoint().

The question is for the implementation of the interface; I see two 
options, either the interface allows mounton for all file-like classes, 
or the classes are specified as a parameter:

--------
init.te:
attribute init_mountpoint_type;
allow init_t init_mountpoint_type:dir_file_class_set mounton;

init.if:
interface(`init_mountpoint',`
typeattribute $1 init_mountpoint_type;
')
--------

or

--------
init.if:
interface(`init_mountpoint',`
allow init_t $1:$2 mounton;
')
--------

I like the first option because it is clearer since you can see the 
mounton in init.te, but that is excessive access.  The second option 
could be made to look like the first option, but it would need several 
attributes and interfaces, e.g. init_dir_mountpoint_type, 
init_file_mountpoint_type, etc. which isn't so desirable.

Any thoughts on this?

-- 
Chris PeBenito

             reply index

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-09 21:06 Chris PeBenito [this message]
2020-01-09 21:42 ` Dominick Grift
2020-01-12 17:41   ` Nicolas Iooss
2020-01-13  9:42   ` Dominick Grift
2020-01-13 10:18     ` Dominick Grift

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3418ebca-80c0-b10e-c0a2-a80427fdbf71@ieee.org \
    --to=pebenito@ieee.org \
    --cc=selinux-refpolicy@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

SELinux-Refpolicy Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux-refpolicy/0 selinux-refpolicy/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux-refpolicy selinux-refpolicy/ https://lore.kernel.org/selinux-refpolicy \
		selinux-refpolicy@vger.kernel.org
	public-inbox-index selinux-refpolicy

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux-refpolicy


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git