: force a label on the fc_sort executable

Force a bin_t label on the fc_sort executable after creating it, to avoid possible execution denials under certain conditions.

Signed-off-by Guido Trentalancia <[email protected]>

---
 Makefile |    1 +
 1 file changed, 1 insertion(+)

Quoted 16 lines · Guido Trentalancia

Force a bin_t label on the fc_sort executable after creating it, to avoid possible execution denials under certain conditions.

Signed-off-by Guido Trentalancia <[email protected]>

---
  Makefile |    1 +
  1 file changed, 1 insertion(+)

Makefile +1 -0

@@ -400,6 +400,7 @@ $(mod_conf) $(booleans): $(polxml)
  #
  $(fcsort) : $(support)/fc_sort.c
  	$(verbose) $(CC) $(CFLAGS) $^ -o $@
+	chcon system_u:object_r:bin_t:s0 $(tmpdir)/fc_sort
 

Makefile $(mod_conf) $(booleans): $(polxml) · line 406

Quoted 2 lines

Makefile +0 -0

  ########################################
  #

I'm not sure this actually is a good choice because this may be done on a different system than where the policy will be deployed. It may have a different policy running or even SELinux disabled.

Quoted 13 lines · Christopher J. PeBenito

Quoted 12 lines · Guido Trentalancia

Force a bin_t label on the fc_sort executable after creating it, to avoid possible execution denials under certain conditions.

Signed-off-by Guido Trentalancia <[email protected]> --- Makefile

| 1 + 1 file changed, 1 insertion(+)

--- refpolicy-04062012/Makefile 2012-05-29 21:13:09.413703575 +0200 +++
refpolicy-04062012-chcon-fc_sort/Makefile 2012-08-04 21:35:57.396092798
+0200 @@ -400,6 +400,7 @@ $(mod_conf) $(booleans): $(polxml) # $(fcsort) : $(support)/fc_sort.c $(verbose) $(CC) $(CFLAGS) $^ -o $@ + chcon system_u:object_r:bin_t:s0 $(tmpdir)/fc_sort

Quoted 5 lines

Quoted 1 line

######################################## #

I'm not sure this actually is a good choice because this may be done on a different system than where the policy will be deployed. It may have a different policy running or even SELinux disabled.

It doesn't matter whether the policy is deployed elsewhere (this is not being discussed as the problem might be executing fc_sort for building the policy).

It's easy to check if SELinux is enabled (getenforce | grep -q Enforcing && chcon system_u:object_r:bin_t:s0 $(tmpdir)/fc_sort). Or perhaps have it just failing silently.

Regards,

Guido

_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 32 lines · Guido Trentalancia

Quoted 13 lines · Christopher J. PeBenito

Quoted 12 lines · Guido Trentalancia

Force a bin_t label on the fc_sort executable after creating it, to avoid possible execution denials under certain conditions.

Signed-off-by Guido Trentalancia <[email protected]> --- Makefile

| 1 + 1 file changed, 1 insertion(+)

--- refpolicy-04062012/Makefile 2012-05-29 21:13:09.413703575 +0200 +++
refpolicy-04062012-chcon-fc_sort/Makefile 2012-08-04 21:35:57.396092798
+0200 @@ -400,6 +400,7 @@ $(mod_conf) $(booleans): $(polxml) # $(fcsort) : $(support)/fc_sort.c $(verbose) $(CC) $(CFLAGS) $^ -o $@ + chcon system_u:object_r:bin_t:s0 $(tmpdir)/fc_sort

Quoted 5 lines

Quoted 1 line

######################################## #

I'm not sure this actually is a good choice because this may be done on a different system than where the policy will be deployed. It may have a different policy running or even SELinux disabled.

It doesn't matter whether the policy is deployed elsewhere (this is not being discussed as the problem might be executing fc_sort for building the policy).

It's easy to check if SELinux is enabled (getenforce | grep -q Enforcing && chcon system_u:object_r:bin_t:s0 $(tmpdir)/fc_sort). Or perhaps have it just failing silently.

Regards,

Guido

Quoted 3 lines

_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy

selinuxenabeled && chcon system_u:object_r:bin_t:s0 $(tmpdir)/fc_sort).

Would be better...