: patch set to update the git reference policy

policy/modules/system/selinuxutil.te +0 -0

 mls_file_write_all_levels(semanage_t)
 mls_file_read_all_levels(semanage_t)
 

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

policy/modules/system/selinuxutil.te files_read_etc_files(semanage_t) · line 447

Quoted 8 lines · Guido Trentalancia

diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/selinuxutil.te refpolicy-git-18012011-new/policy/modules/system/selinuxutil.te

policy/modules/system/selinuxutil.te +1 -0

@@ -444,6 +444,7 @@ files_read_etc_files(semanage_t)
 files_read_etc_runtime_files(semanage_t)
 files_read_usr_files(semanage_t)
 files_list_pids(semanage_t)
+files_search_default(semanage_t)

There should not be any default_t directories. Thus this shouldnt be allowed.

Quoted 12 lines · Dominick Grift

policy/modules/system/selinuxutil.te files_read_etc_files(semanage_t) · line 447

Quoted 8 lines · Guido Trentalancia

diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/selinuxutil.te refpolicy-git-18012011-new/policy/modules/system/selinuxutil.te

policy/modules/system/selinuxutil.te +1 -0

@@ -444,6 +444,7 @@ files_read_etc_files(semanage_t)
 files_read_etc_runtime_files(semanage_t)
 files_read_usr_files(semanage_t)
 files_list_pids(semanage_t)
+files_search_default(semanage_t)

There should not be any default_t directories. Thus this shouldnt be allowed.

This stems from the fact that at some point I came to a state where while working from the terminal (as opposed to working from a graphical terminal), semanage had trouble dealing with some temporary local modules that I was working with for testing purposes (they were labelled default_t)...

Of course it can be removed. So, in general default_t should never appear anywhere in the policy ? Just for curiosity, what is the reason behind that ? If it is allowed to carry out operations on usr and etc_runtime files, why shouldn't it allowed to carry out operations on default_t ?

Regards,

Guido

Quoted 31 lines · Dominick Grift

Quoted 20 lines · Guido Trentalancia

Quoted 12 lines · Dominick Grift

policy/modules/system/selinuxutil.te files_read_etc_files(semanage_t) · line 447

Quoted 8 lines · Guido Trentalancia

diff -pruN -x .git -x booleans.conf -x corenetwork.if -x corenetwork.te -x modules.conf refpolicy-git-18012011/policy/modules/system/selinuxutil.te refpolicy-git-18012011-new/policy/modules/system/selinuxutil.te

policy/modules/system/selinuxutil.te +1 -0

@@ -444,6 +444,7 @@ files_read_etc_files(semanage_t)
  files_read_etc_runtime_files(semanage_t)
  files_read_usr_files(semanage_t)
  files_list_pids(semanage_t)
+files_search_default(semanage_t)

There should not be any default_t directories. Thus this shouldnt be allowed.

This stems from the fact that at some point I came to a state where while working from the terminal (as opposed to working from a graphical terminal), semanage had trouble dealing with some temporary local modules that I was working with for testing purposes (they were labelled default_t)...

Quoted 5 lines

Of course it can be removed. So, in general default_t should never appear anywhere in the policy ? Just for curiosity, what is the reason behind that ? If it is allowed to carry out operations on usr and etc_runtime files, why shouldn't it allowed to carry out operations on default_t ?

locations unknown to selinux are labelled default_t. So for example if you create a dir named /test in the root of the filesystem. There is no file context specification for it and thus selinux labels it default_t.

Quoted 8 lines

Basically it signals some incompatibility in that sense because files always need a label, and this should not happen.

Why should refpolicy support a scenario that should never happen in the first place? default_t is not like other types like usr_t or etc_runtime_t. types like file_t, default_t, unlabeled_t all signal some other issues. I think this is discussed in "Fedora SELinux user guide" (you can find it with google, its a free document.

This is the right idea, but I want to clarify the labeling.

default_t: this means no entry in file_contexts matches this file, so it falls back to default_t.

unlabeled_t: this means the object has an invalid context. Typically this happens if a type is removed from the policy while the system is running.

file_t: this means a filesystem that supports extended attributes is mounted for the first time on a SELinux system. The default for the files in this case is file_t.

In all of these cases, the security attributes of the object are unknown.