Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types.
PATCH 1/1 Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types.
policy/modules/kernel/domain.if +2 -8
@@ -623,10 +623,7 @@ attribute domain; ') - kernel_search_proc($1) - allow $1 domain:dir list_dir_perms; - read_files_pattern($1, domain, domain) - read_lnk_files_pattern($1, domain, domain) + ps_process_pattern($1, domain) ') ########################################
@@ -683,10 +680,7 @@ attribute domain, unconfined_domain_type; ') - kernel_search_proc($1) - allow $1 { domain -unconfined_domain_type }:dir list_dir_perms; - read_files_pattern($1, { domain -unconfined_domain_type }, { domain -unconfined_domain_type }) - read_lnk_files_pattern($1, { domain -unconfined_domain_type }, { domain -unconfined_domain_type }) + ps_process_pattern($1, { domain -unconfined_domain_type }) dontaudit $1 unconfined_domain_type:dir search_dir_perms; dontaudit $1 unconfined_domain_type:file read_file_perms;
PATCH 1/1 Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types.
Quoted 20 lines · Dominick Grift
Signed-off-by Dominick Grift <[email protected]>policy/modules/kernel/domain.if +1
-4@@ -623,10 +623,7 @@ attribute domain; ') - kernel_search_proc($1) - allow $1 domain:dir list_dir_perms; - read_files_pattern($1, domain, domain) - read_lnk_files_pattern($1, domain, domain) + ps_process_pattern($1, domain) ') ########################################@@ -683,10 +680,7 @@ attribute domain, unconfined_domain_type;
policy/modules/kernel/domain.if line 686
Quoted 10 lines
policy/modules/kernel/domain.if +1
-4') - kernel_search_proc($1) - allow $1 { domain -unconfined_domain_type }:dir list_dir_perms; - read_files_pattern($1, { domain -unconfined_domain_type }, { domain -unconfined_domain_type }) - read_lnk_files_pattern($1, { domain -unconfined_domain_type }, { domain -unconfined_domain_type }) + ps_process_pattern($1, { domain -unconfined_domain_type }) dontaudit $1 unconfined_domain_type:dir search_dir_perms; dontaudit $1 unconfined_domain_type:file read_file_perms;
I'd have to say no to this patch. As you say, not all domains that read other domains' state needs to getattr the process.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types.
Quoted 2 lines · Christopher J. PeBenito
I'd have to say no to this patch. As you say, not all domains that read other domains' state needs to getattr the process.
ok, but why is that problem big enough to not use the cleaner ps_process_pattern. and why does the ps_process_pattern include the getattr?
PATCH 1/1 Use ps_process_pattern() in domain_read_state interfaces. Seem though that not everyone read domain state needs to be able to get attributes of target process types.
Quoted 5 lines · Dominick Grift
Quoted 1 line · Christopher J. PeBenito
I'd have to say no to this patch. As you say, not all domains that read other domains' state needs to getattr the process.
ok, but why is that problem big enough to not use the cleaner
ps_process_pattern. and why does theps_process_patterninclude the getattr?
It originated to support ps, including ps -Z.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com