Added KDE and Konqueror policy. Made necessary changes in staff, unprivuser and unconfined, for it to work.
A message that is not in the archive (sent off-list or not yet received): [email protected]
PATCH 1/1 Added KDE and Konqueror policy. Made necessary changes in staff, unprivuser and unconfined, for it to work.
Thanks for your comments, I'll provide a better patch soon. In the meantime just some notes and questions.
Quoted 7 lines
Review
Quoted 5 lines
(quoted diff) +5
-0+# Temp acces for konqueror +manage_dirs_pattern(konqueror_t, konqueror_tmp_t, konqueror_tmp_t) +manage_lnk_files_pattern(konqueror_t, konqueror_tmp_t, konqueror_tmp_t) +manage_sock_files_pattern(konqueror_t, konqueror_tmp_t, konqueror_tmp_t) +manage_files_pattern(konqueror_t, konqueror_tmp_t, konqueror_tmp_t)This does probably require the user to be able to manage it
What do you mean by this?
Quoted 11 lines
Review
Quoted 3 lines
(quoted diff) +3
-0+ konqueror_role(staff_r, staff_t) +') +Should probably go into userdomain (common use template), but i believe that for reference policy these calls are not required at all (gets called automatically)
Quoted 2 lines
+
konqueror_role(user_r, user_t)
+')
Quoted 7 lines
Same as above
Review
Quoted 3 lines
(quoted diff) +3
-0+ konqueror_role(unconfined_r, unconfined_t) +') +Not sure whether it is a good idea run let
unconfined_ttransition
Well I'm definitely confused about where to place these calls. Fedora has it somewhere, refpolicy elsewhere. Could somebody provide explanation about it?
Quoted 16 lines
Quoted 13 lines
+HOME_DIR/\.kde/share/config/konq_history -- gen_context(system_u:object_
r:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/config/konquerorrc -- gen_context(system_u:object_
r:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/config/konqsidebartng.rc -- gen_context(system_u:ob
ject_r:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/config/kuriikwsfilterrc -- gen_context(system_u:obj
ect_r:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/apps/konqueror(/.*)? gen_context(system_u:object_r
:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/apps/khtml(/.*)? gen_context(system_u:object_r:ko
nqueror_home_t,s0)Why not just
kde_shared_home_tfor everything in ~/.kde
Well, I hope this policy to be just a first step in constructing policies for other KDE aplications, which I think should be also confined from each other, so that e.g. a weakness in KDE browser would not endager contacts in KDE mail client.
Quoted 3 lines
Quoted 1 line
+gen_tunable(konqueror_exec_bin_t, false)
This shouldnt be tunable
Hm, I made it tunable, because I didn't feel quite right to let konqueror run bin_t just because of some bug reporting tool. Maybe that was not good idea... Any special reasons why it sould not be tunable?
Thanx for your time,
Ondrej Vadinsk?
Signature · 5 lines
Don`t it always seem to go That you don`t know what you`ve got Till it`s gone. (Joni Mitchell)
PATCH 1/1 Added KDE and Konqueror policy. Made necessary changes in staff, unprivuser and unconfined, for it to work.
Quoted 10 lines · On 01/30/2010 08:02 PM, Nicky726 wrote:
Thanks for your comments, I'll provide a better patch soon. In the meantime just some notes and questions.
Quoted 7 lines
Review
Quoted 5 lines
(quoted diff) +5
-0+# Temp acces for konqueror +manage_dirs_pattern(konqueror_t, konqueror_tmp_t, konqueror_tmp_t) +manage_lnk_files_pattern(konqueror_t, konqueror_tmp_t, konqueror_tmp_t) +manage_sock_files_pattern(konqueror_t, konqueror_tmp_t, konqueror_tmp_t) +manage_files_pattern(konqueror_t, konqueror_tmp_t, konqueror_tmp_t)This does probably require the user to be able to manage it
Well this content (i assume) is shared between konqueror and users. So in that case users must be able to manage this content.
Quoted 12 lines
What do you mean by this?
Quoted 10 lines
Review
Quoted 3 lines
(quoted diff) +3
-0+ konqueror_role(staff_r, staff_t) +') +Should probably go into userdomain (common use template), but i believe that for reference policy these calls are not required at all (gets called automatically)
Quoted 2 lines
+
konqueror_role(user_r, user_t)
+')
Fedora calls role templates in userdom.if (the common user template) Refpolicy (i think) uses a mechanism that automatically calls the per role templates. So you do not have to call the template explicitly like you do above.
Quoted 28 lines
Quoted 7 lines
Same as above
Review
Quoted 3 lines
(quoted diff) +3
-0+ konqueror_role(unconfined_r, unconfined_t) +') +Not sure whether it is a good idea run let
unconfined_ttransitionWell I'm definitely confused about where to place these calls. Fedora has it somewhere, refpolicy elsewhere. Could somebody provide explanation about it?
Quoted 16 lines
Quoted 13 lines
+HOME_DIR/\.kde/share/config/konq_history -- gen_context(system_u:object_
r:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/config/konquerorrc -- gen_context(system_u:object_
r:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/config/konqsidebartng.rc -- gen_context(system_u:ob
ject_r:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/config/kuriikwsfilterrc -- gen_context(system_u:obj
ect_r:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/apps/konqueror(/.*)? gen_context(system_u:object_r
:konqueror_home_t,s0) +
+HOME_DIR/\.kde/share/apps/khtml(/.*)? gen_context(system_u:object_r:ko
nqueror_home_t,s0)Why not just
kde_shared_home_tfor everything in ~/.kde
Quoted 5 lines
Well, I hope this policy to be just a first step in constructing policies for other KDE aplications, which I think should be also confined from each other, so that e.g. a weakness in KDE browser would not endager contacts in KDE mail client.
I see. The issue i guess is the "filetrans_pattern". It is not in the base module. That means you will probably use it in an optional policy block Also you will not be able to use attributes for this type of content properly. Other than that i agree that it is a good idea. The problem is that refpolicy propbably will not accept it.
Quoted 7 lines
Quoted 3 lines
Quoted 1 line
+gen_tunable(konqueror_exec_bin_t, false)
This shouldnt be tunable
Hm, I made it tunable, because I didn't feel quite right to let konqueror run
bin_tjust because of some bug reporting tool. Maybe that was not good idea... Any special reasons why it sould not be tunable?
Well i think tunables should only de used for things that affect security in significant ways. You could consider to just dontaudit it altogether although that is not a proper solution either.
Quoted 3 lines
Thanx for your time,
Ondrej Vadinsk?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 261 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100130/89a9f587/attachment.bin