Mark use of deprecated interfaces that are not providing replacement as errors

From: Mika Pfl?ger <[email protected]>

Add a new boolean to grant users access to dosfs_t.

---
  policy/global_tunables              |    7 +++++++
  policy/modules/system/userdomain.if |    6 ++++++
  2 files changed, 13 insertions(+)

policy/global_tunables +0 -0

index 4705ab6..43cc19a 100644

policy/modules/system/userdomain.if +0 -0

index e720dcd..0c96b65 100644
@@ -117,6 +117,12 @@ template(`userdom_base_user_template',`
  		# Allow making the stack executable via mprotect.
  		allow $1_t self:process execstack;

policy/global_tunables gen_tunable(use_samba_home_dirs,false) · line 120

Quoted 6 lines

policy/global_tunables +3 -0

+## <desc>
+## <p>
+## Allow users to manage files on dosfs_t devices, usually removable

media +## </p>

policy/global_tunables +2 -0

+## </desc>
+gen_tunable(user_manage_dos_files,true)

In my opinion is good to have this as on option, but in a secure environment the default should be false for removable media.

Quoted 9 lines · Guido Trentalancia

policy/global_tunables gen_tunable(use_samba_home_dirs,false) · line 120

Quoted 6 lines

policy/global_tunables +3 -0

+## <desc>
+## <p>
+## Allow users to manage files on dosfs_t devices, usually removable

media +## </p>

policy/global_tunables +2 -0

+## </desc>
+gen_tunable(user_manage_dos_files,true)

In my opinion is good to have this as on option, but in a secure environment the default should be false for removable media.

It's one setsebool command to make it "secure" in that regard. I think that for most systems where you really don't want users reading files on FAT filesystems you won't have the ability to even mount them (remove USB ports etc). For the majority of servers there will be no physical access by untrusted users. For the majority of desktop systems such access will be desired and it's one more potential thing for less clueful people to cite as a reason for not using SE Linux if it doesn't work by default.

Quoted 18 lines · Laurent Bigonville

From: Mika Pfl?ger <[email protected]>

Add a new boolean to grant users access to dosfs_t.

---
  policy/global_tunables              |    7 +++++++
  policy/modules/system/userdomain.if |    6 ++++++
  2 files changed, 13 insertions(+)

policy/global_tunables +2 -0

index 4705ab6..43cc19a 100644
@@ -111,3 +111,10 @@ gen_tunable(use_samba_home_dirs,false)
  ## </p>
  ## </desc>
  gen_tunable(user_tcp_server,false)
+
+## <desc>

policy/global_tunables gen_tunable(use_samba_home_dirs,false) · line 120

Quoted 5 lines

policy/global_tunables +5 -0

+## <p>
+## Allow users to manage files on dosfs_t devices, usually removable media
+## </p>
+## </desc>
+gen_tunable(user_manage_dos_files,true)

In my opinion is good to have this as on option, but in a secure environment the default should be false for removable media.

Quoted 8 lines

policy/modules/system/userdomain.if +0 -0

index e720dcd..0c96b65 100644
@@ -117,6 +117,12 @@ template(`userdom_base_user_template',`
  		# Allow making the stack executable via mprotect.
  		allow $1_t self:process execstack;

policy/modules/system/userdomain.if template(`userdom_base_user_template',` · line 128

Quoted 10 lines

policy/modules/system/userdomain.if +6 -0

  	')
+
+	tunable_policy(`user_manage_dos_files',`
+		fs_manage_dos_dirs($1_t)
+		fs_manage_dos_files($1_t)
+	')
+
  ')
 
  #######################################

Regards,

Guido
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 19 lines · Guido Trentalancia

Quoted 18 lines · Laurent Bigonville

From: Mika Pfl?ger <[email protected]>

Add a new boolean to grant users access to dosfs_t.

---
   policy/global_tunables              |    7 +++++++
   policy/modules/system/userdomain.if |    6 ++++++
   2 files changed, 13 insertions(+)

policy/global_tunables +2 -0

index 4705ab6..43cc19a 100644
@@ -111,3 +111,10 @@ gen_tunable(use_samba_home_dirs,false)
   ## </p>
   ## </desc>
   gen_tunable(user_tcp_server,false)
+
+## <desc>

Quoted 8 lines

policy/global_tunables gen_tunable(use_samba_home_dirs,false) · line 120

Quoted 5 lines

policy/global_tunables +5 -0

+## <p>
+## Allow users to manage files on dosfs_t devices, usually removable media
+## </p>
+## </desc>
+gen_tunable(user_manage_dos_files,true)

In my opinion is good to have this as on option, but in a secure environment the default should be false for removable media.

i would prefer the boolean to be fprefix userdom or userdomain instead of user, because that it the module that declares this boolean.

Since the user is also allowed to manage dos dirs i would probably call
it: userdomain_manage_dos_content

as description i would use:

"Determine whether users can manage dosfs content."

Quoted 17 lines

Quoted 17 lines

policy/modules/system/userdomain.if +6 -0

index e720dcd..0c96b65 100644
@@ -117,6 +117,12 @@ template(`userdom_base_user_template',`
   		# Allow making the stack executable via mprotect.
   		allow $1_t self:process execstack;
   	')
+
+	tunable_policy(`user_manage_dos_files',`
+		fs_manage_dos_dirs($1_t)
+		fs_manage_dos_files($1_t)
+	')
+
   ')
 
   #######################################

Quoted 25 lines · Dominick Grift

Quoted 8 lines · Guido Trentalancia

Quoted 7 lines · Laurent Bigonville

From: Mika Pfl?ger <[email protected]>

Add a new boolean to grant users access to dosfs_t. ---

policy/global_tunables              |    7 +++++++ 
policy/modules/system/userdomain.if |    6 ++++++ 2 files changed, 13

insertions(+)

Quoted 10 lines

Quoted 7 lines

policy/global_tunables index renamed from policy/global_tunables +0 -0

4705ab6..43cc19a 100644 --- a/policy/global_tunables +++ b/policy/global_tunables @@ -111,3 +111,10 @@ gen_tunable(use_samba_home_dirs,false) ## </p> ## </desc> gen_tunable(user_tcp_server,false) + +## <desc> +## <p> +## Allow users to manage files on dosfs_t devices, usually removable media +## </p> +## </desc> +gen_tunable(user_manage_dos_files,true)

In my opinion is good to have this as on option, but in a secure environment the default should be false for removable media.

i would prefer the boolean to be fprefix userdom or userdomain instead of user, because that it the module that declares this boolean.

Quoted 6 lines

Since the user is also allowed to manage dos dirs i would probably call
it: userdomain_manage_dos_content

as description i would use:

"Determine whether users can manage dosfs content."

I agree. And, in particular it's not "dos files" which can be confusing, but dos filesystems which is already perfectioned in Dominick's amendments.

Quoted 9 lines

Quoted 9 lines

Quoted 9 lines

(quoted diff) +0 -0

b/policy/modules/system/userdomain.if index e720dcd..0c96b65 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -117,6 +117,12 @@ template(userdom_base_user_template', # Allow making the stack executable via mprotect. allow $1_t self:process execstack; ') + +
tunable_policy(user_manage_dos_files', + fs_manage_dos_dirs($1_t)

policy/global_tunables index renamed from policy/global_tunables +1 -0

+		fs_manage_dos_files($1_t) +	') + ')

Quoted 1 line

Quoted 1 line

Quoted 1 line

#######################################

_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 46 lines · Guido Trentalancia

Quoted 25 lines · Dominick Grift

Quoted 8 lines · Guido Trentalancia

Quoted 7 lines · Laurent Bigonville

From: Mika Pfl?ger <[email protected]>

Add a new boolean to grant users access to dosfs_t. ---

policy/global_tunables              |    7 +++++++
policy/modules/system/userdomain.if |    6 ++++++ 2 files changed, 13

insertions(+)

Quoted 10 lines

Quoted 7 lines

policy/global_tunables index renamed from policy/global_tunables +0 -0

4705ab6..43cc19a 100644 --- a/policy/global_tunables +++ b/policy/global_tunables @@ -111,3 +111,10 @@ gen_tunable(use_samba_home_dirs,false) ## </p> ## </desc> gen_tunable(user_tcp_server,false) + +## <desc> +## <p> +## Allow users to manage files on dosfs_t devices, usually removable media +## </p> +## </desc> +gen_tunable(user_manage_dos_files,true)

In my opinion is good to have this as on option, but in a secure environment the default should be false for removable media.

i would prefer the boolean to be fprefix userdom or userdomain instead of user, because that it the module that declares this boolean.

Quoted 6 lines

Since the user is also allowed to manage dos dirs i would probably call
it: userdomain_manage_dos_content

as description i would use:

"Determine whether users can manage dosfs content."

I agree. And, in particular it's not "dos files" which can be confusing, but dos filesystems which is already perfectioned in Dominick's amendments.

Quoted 9 lines

Quoted 9 lines

Quoted 9 lines

(quoted diff) +0 -0

b/policy/modules/system/userdomain.if index e720dcd..0c96b65 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -117,6 +117,12 @@ template(userdom_base_user_template', # Allow making the stack executable via mprotect. allow $1_t self:process execstack; ') + +
tunable_policy(user_manage_dos_files', + fs_manage_dos_dirs($1_t)

policy/global_tunables index renamed from policy/global_tunables +1 -0

+		fs_manage_dos_files($1_t) +	') + ')

Quoted 5 lines

Quoted 1 line

Quoted 1 line

Quoted 1 line

#######################################

_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy

I think all booleans should be off by default and then the distributions can decide which booleans to turn on using the booleans.conf file. This would allow us one file to look at to see what is enabled.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 46 lines · Guido Trentalancia

Quoted 25 lines · Dominick Grift

Quoted 8 lines · Guido Trentalancia

Quoted 7 lines · Laurent Bigonville

From: Mika Pfl?ger <[email protected]>

Add a new boolean to grant users access to dosfs_t. ---

policy/global_tunables              |    7 +++++++
policy/modules/system/userdomain.if |    6 ++++++ 2 files changed, 13

insertions(+)

Quoted 10 lines

Quoted 7 lines

policy/global_tunables index renamed from policy/global_tunables +0 -0

4705ab6..43cc19a 100644 --- a/policy/global_tunables +++ b/policy/global_tunables @@ -111,3 +111,10 @@ gen_tunable(use_samba_home_dirs,false) ## </p> ## </desc> gen_tunable(user_tcp_server,false) + +## <desc> +## <p> +## Allow users to manage files on dosfs_t devices, usually removable media +## </p> +## </desc> +gen_tunable(user_manage_dos_files,true)

In my opinion is good to have this as on option, but in a secure environment the default should be false for removable media.

i would prefer the boolean to be fprefix userdom or userdomain instead of user, because that it the module that declares this boolean.

Quoted 6 lines

Since the user is also allowed to manage dos dirs i would probably call
it: userdomain_manage_dos_content

as description i would use:

"Determine whether users can manage dosfs content."

I agree. And, in particular it's not "dos files" which can be confusing, but dos filesystems which is already perfectioned in Dominick's amendments.

Quoted 9 lines

Quoted 9 lines

Quoted 9 lines

(quoted diff) +0 -0

b/policy/modules/system/userdomain.if index e720dcd..0c96b65 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -117,6 +117,12 @@ template(userdom_base_user_template', # Allow making the stack executable via mprotect. allow $1_t self:process execstack; ') + +
tunable_policy(user_manage_dos_files', + fs_manage_dos_dirs($1_t)

policy/global_tunables index renamed from policy/global_tunables +1 -0

+		fs_manage_dos_files($1_t) +	') + ')

Quoted 5 lines

Quoted 1 line

Quoted 1 line

Quoted 1 line

#######################################

_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy

I think all booleans should be off by default and then the distributions can decide which booleans to turn on using the booleans.conf file. This would allow us one file to look at to see what is enabled.

Hello Daniel.

Following your reflections, I have checked the current situation and I share the concerns, so I have created a patch which disables most tunable policy booleans (except network and the mcelog module as it deals amongst other things with CPU thermal events which can be related to hardware failures).

Quoted 58 lines · Daniel J Walsh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Quoted 49 lines · Guido Trentalancia

Quoted 27 lines · Dominick Grift

Quoted 8 lines · Guido Trentalancia

Quoted 7 lines · Laurent Bigonville

From: Mika Pfl?ger <[email protected]>

Add a new boolean to grant users access to dosfs_t. ---

policy/global_tunables              |    7 +++++++ 
policy/modules/system/userdomain.if |    6 ++++++ 2 files

changed, 13 insertions(+)

Quoted 11 lines

Quoted 8 lines

policy/global_tunables +0 -0

index 4705ab6..43cc19a 100644 --- a/policy/global_tunables +++ 

b/policy/global_tunables @@ -111,3 +111,10 @@ gen_tunable(use_samba_home_dirs,false) ## </p> ## </desc> gen_tunable(user_tcp_server,false) + +## <desc> +## <p> +## Allow users to manage files on dosfs_t devices, usually removable media +## </p> +## </desc> +gen_tunable(user_manage_dos_files,true)

In my opinion is good to have this as on option, but in a secure environment the default should be false for removable media.

i would prefer the boolean to be fprefix userdom or userdomain instead of user, because that it the module that declares this boolean.

Quoted 6 lines

Since the user is also allowed to manage dos dirs i would probably call it: userdomain_manage_dos_content

as description i would use:

"Determine whether users can manage dosfs content."

I agree. And, in particular it's not "dos files" which can be confusing, but dos filesystems which is already perfectioned in Dominick's amendments.

Quoted 10 lines

Quoted 10 lines

Quoted 10 lines

(quoted diff) +0 -0

b/policy/modules/system/userdomain.if index e720dcd..0c96b65 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -117,6 +117,12 @@ template(userdom_base_user_template', # Allow making the stack executable via mprotect. allow $1_t self:process execstack; ') +
+ tunable_policy(user_manage_dos_files', +
fs_manage_dos_dirs($1_t) + fs_manage_dos_files($1_t) +
') + ')

Quoted 6 lines

Quoted 1 line

Quoted 1 line

Quoted 1 line

#######################################

_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 3 lines

I think all booleans should be off by default and then the distributions can decide which booleans to turn on using the booleans.conf file. This would allow us one file to look at to see what is enabled.

Turn off all/most tunable policy booleans by default in Reference Policy (except network).

They can be enabled on a per-distribution basis and many of those that were enabled were somehow risky as defaults.

Signed-off-by Guido Trentalancia <[email protected]> ---

diff -pru refpolicy-09062012-git-master/policy/modules/contrib/mcelog.te refpolicy-09062012-safe-default-booleans/policy/modules/contrib/mcelog.te
--- refpolicy-09062012-git-master/policy/modules/contrib/mcelog.te Thu

Aug 23 19:23:00 2012 +++

refpolicy-09062012-safe-default-booleans/policy/modules/contrib/mcelog.te
Thu Sep 6 10:56:21 2012 @@ -30,7 +30,7 @@
gen_tunable(mcelog_exec_scripts, true) ## print out usage and version information. ## </p> ## </desc> -gen_tunable(mcelog_foreground, true) +gen_tunable(mcelog_foreground, false)

## <desc> ## <p> @@ -48,7 +48,7 @@ gen_tunable(mcelog_server, false) ## syslog option. ## </p> ## </desc> -gen_tunable(mcelog_syslog, true) +gen_tunable(mcelog_syslog, false)

type mcelog_t; type mcelog_exec_t; diff -pru refpolicy-09062012-git-master/policy/modules/contrib/qemu.te refpolicy-09062012-safe-default-booleans/policy/modules/contrib/qemu.te ---
refpolicy-09062012-git-master/policy/modules/contrib/qemu.te Thu Aug 23
19:23:00 2012 +++ refpolicy-09062012-safe-default-booleans/policy/modules/contrib/qemu.te Thu Sep 6 10:53:27 2012 @@ -17,7 +17,7 @@ gen_tunable(qemu_full_network, false) ## Allow qemu to use cifs/Samba file systems ## </p> ## </desc> -gen_tunable(qemu_use_cifs, true) +gen_tunable(qemu_use_cifs, false)

## <desc> ## <p> @@ -31,14 +31,14 @@ gen_tunable(qemu_use_comm, false) ## Allow qemu to use nfs file systems ## </p> ## </desc> -gen_tunable(qemu_use_nfs, true) +gen_tunable(qemu_use_nfs, false)

## <desc> ## <p> ## Allow qemu to use usb devices ## </p> ## </desc> -gen_tunable(qemu_use_usb, true) +gen_tunable(qemu_use_usb, false)

type qemu_exec_t; virt_domain_template(qemu) diff -pru refpolicy-09062012-git-master/policy/modules/contrib/rpc.te refpolicy-09062012-safe-default-booleans/policy/modules/contrib/rpc.te ---
refpolicy-09062012-git-master/policy/modules/contrib/rpc.te Thu Aug 23
19:23:00 2012 +++ refpolicy-09062012-safe-default-booleans/policy/modules/contrib/rpc.te Thu

Sep  6 10:54:59 2012 @@ -10,7 +10,7 @@ policy_module(rpc, 1.14.0) ## Allow

gssd to read temp directory. For access to kerberos tgt. ## </p> ## </desc> -gen_tunable(allow_gssd_read_tmp, true) +gen_tunable(allow_gssd_read_tmp, false)

## <desc> ## <p> diff -pru refpolicy-09062012-git-master/policy/modules/contrib/spamassassin.te refpolicy-09062012-safe-default-booleans/policy/modules/contrib/spamassassin.te

Aug 23 19:23:00 2012 +++ 

refpolicy-09062012-safe-default-booleans/policy/modules/contrib/spamassassin.te

(quoted diff) +0 -0

@@ -17,7 +17,7 @@ gen_tunable(spamassassin_can_network, fa ## Allow spamd

to read/write user home directories. ## </p> ## </desc>

(quoted diff) +1 -1

-gen_tunable(spamd_enable_home_dirs, true) 
+gen_tunable(spamd_enable_home_dirs, false)

type spamassassin_t; type spamassassin_exec_t; diff -pru refpolicy-09062012-git-master/policy/modules/contrib/virt.te refpolicy-09062012-safe-default-booleans/policy/modules/contrib/virt.te ---
refpolicy-09062012-git-master/policy/modules/contrib/virt.te Thu Aug 23
19:23:00 2012 +++ refpolicy-09062012-safe-default-booleans/policy/modules/contrib/virt.te Thu Sep 6 10:54:05 2012 @@ -45,7 +45,7 @@ gen_tunable(virt_use_sysfs, false) ## Allow virt to use usb devices ## </p> ## </desc> -gen_tunable(virt_use_usb, true) +gen_tunable(virt_use_usb, false)

virt_domain_template(svirt) role system_r types svirt_t; diff -pru refpolicy-09062012-git-master/policy/modules/contrib/xen.te refpolicy-09062012-safe-default-booleans/policy/modules/contrib/xen.te ---
refpolicy-09062012-git-master/policy/modules/contrib/xen.te Thu Aug 23
19:23:00 2012 +++ refpolicy-09062012-safe-default-booleans/policy/modules/contrib/xen.te Thu

Sep  6 10:54:41 2012 @@ -11,7 +11,7 @@ policy_module(xen, 1.12.0) ## Not

required if using dedicated logical volumes for disk images. ## </p> ## </desc> -gen_tunable(xend_run_blktap, true) +gen_tunable(xend_run_blktap, false)

## <desc> ## <p> @@ -19,7 +19,7 @@ gen_tunable(xend_run_blktap, true) ## Not required if using paravirt and no vfb. ## </p> ## </desc> -gen_tunable(xend_run_qemu, true) +gen_tunable(xend_run_qemu, false)

## <desc> ## <p> diff -pru refpolicy-09062012-git-master/policy/modules/contrib/xguest.te refpolicy-09062012-safe-default-booleans/policy/modules/contrib/xguest.te
--- refpolicy-09062012-git-master/policy/modules/contrib/xguest.te Thu

Aug 23 19:23:00 2012 +++

refpolicy-09062012-safe-default-booleans/policy/modules/contrib/xguest.te
Thu Sep 6 10:53:49 2012 @@ -10,21 +10,21 @@ policy_module(xguest, 1.1.0)
## Allow xguest users to mount removable media ## </p> ## </desc> -gen_tunable(xguest_mount_media, true) +gen_tunable(xguest_mount_media, false)

## <desc> ## <p> ## Allow xguest to configure Network Manager ## </p> ## </desc> -gen_tunable(xguest_connect_network, true) +gen_tunable(xguest_connect_network, false)

## <desc> ## <p> ## Allow xguest to use blue tooth devices ## </p> ## </desc> -gen_tunable(xguest_use_bluetooth, true) +gen_tunable(xguest_use_bluetooth, false)

role xguest_r;

diff -pru refpolicy-09062012-git-master/policy/modules/services/postgresql.te refpolicy-09062012-safe-default-booleans/policy/modules/services/postgresql.te

6 10:50:18 2012 +++ refpolicy-09062012-safe-default-booleans/policy/modules/services/postgresql.te

(quoted diff) +1 -0

@@ -23,7 +23,7 @@ gen_require(` ## Allow unprived users to execute DDL
 statement ## </p> ## </desc> -gen_tunable(sepgsql_enable_users_ddl, true) 
+gen_tunable(sepgsql_enable_users_ddl, false)
 
 ## <desc> ## <p> @@ -37,7 +37,7 @@

gen_tunable(sepgsql_transmit_client_labe ## Allow database admins to execute DML statement ## </p> ## </desc>

(quoted diff) +1 -1

-gen_tunable(sepgsql_unconfined_dbadm, true) 
+gen_tunable(sepgsql_unconfined_dbadm, false)

type postgresql_t; type postgresql_exec_t;

From: Mika Pfl??ger <[email protected]>

Add a new boolean to grant users access to dosfs_t.

---
 policy/global_tunables              |    7 +++++++
 policy/modules/system/userdomain.if |    6 ++++++
 2 files changed, 13 insertions(+)

policy/global_tunables +0 -0

index 4705ab6..092df0b 100644

policy/modules/system/userdomain.if +0 -0

index e720dcd..949c738 100644

Le Tue, 4 Sep 2012 23:21:08 +0200,
Laurent Bigonville <[email protected]> a ?crit :

policy/modules/system/userdomain.if template(`userdom_base_user_template',` · line 126

Quoted 6 lines

policy/modules/system/userdomain.if +5 -0

+	tunable_policy(`user_manage_dos_files',`
+		fs_manage_dos_dirs($1_t)
+		fs_manage_dos_files($1_t)
+	')
+
  ')

I was reading the code further and isn't the proposed patch actually redundant with user_rw_noexattrfile?

         tunable_policy(`user_rw_noexattrfile',`
                 fs_manage_noxattr_fs_files($1_t)
                 fs_manage_noxattr_fs_dirs($1_t)
         ',`
                 fs_read_noxattr_fs_files($1_t)
         ')

So shouldn't the proposed patch simply be dropped?

Cheers

Laurent Bigonville

Quoted 20 lines · Laurent Bigonville

Le Tue, 4 Sep 2012 23:21:08 +0200,
Laurent Bigonville <[email protected]> a ?crit :

policy/modules/system/userdomain.if template(`userdom_base_user_template',` · line 126

Quoted 6 lines

policy/modules/system/userdomain.if +5 -0

+	tunable_policy(`user_manage_dos_files',`
+		fs_manage_dos_dirs($1_t)
+		fs_manage_dos_files($1_t)
+	')
+
   ')

I was reading the code further and isn't the proposed patch actually redundant with user_rw_noexattrfile?

          tunable_policy(`user_rw_noexattrfile',`
                  fs_manage_noxattr_fs_files($1_t)
                  fs_manage_noxattr_fs_dirs($1_t)
          ',`
                  fs_read_noxattr_fs_files($1_t)
          ')

Quoted 1 line

So shouldn't the proposed patch simply be dropped?

Fortunately, it has not been applied, I think. And if it causes problems and degradation of current policy, as you now recognize, why did you post it in the first place then ?

Quoted 20 lines · Laurent Bigonville

Le Tue, 4 Sep 2012 23:21:08 +0200,
Laurent Bigonville <[email protected]> a ?crit :

policy/modules/system/userdomain.if template(`userdom_base_user_template',` · line 126

Quoted 6 lines

policy/modules/system/userdomain.if +5 -0

+	tunable_policy(`user_manage_dos_files',`
+		fs_manage_dos_dirs($1_t)
+		fs_manage_dos_files($1_t)
+	')
+
   ')

I was reading the code further and isn't the proposed patch actually redundant with user_rw_noexattrfile?

          tunable_policy(`user_rw_noexattrfile',`
                  fs_manage_noxattr_fs_files($1_t)
                  fs_manage_noxattr_fs_dirs($1_t)
          ',`
                  fs_read_noxattr_fs_files($1_t)
          ')

Quoted 1 line

So shouldn't the proposed patch simply be dropped?

Fortunately, it has not been applied, I think. And if it causes problems and degradation of current policy, as you now recognize, why did you post it in the first place then ?

From: Mika Pfl?ger <[email protected]>

---
  policy/modules/system/iptables.te |    1 +
  1 file changed, 1 insertion(+)

policy/modules/system/iptables.te +0 -0

index 0646ee7..6f2fb69 100644

Quoted 5 lines

+kernel_request_load_module(iptables_t)

allow iptables_t self:capability { dac_read_search dac_override
net_admin net_raw }; dontaudit iptables_t self:capability sys_tty_config;
allow iptables_t self:fifo_file rw_fifo_file_perms;

Is this for IPv6 ? It was not recommended in NSA security guidelines. Has this now been changed ? If not, then perhaps it can be enclosed in tunable policy ?

Quoted 6 lines · Guido Trentalancia

Quoted 5 lines

+kernel_request_load_module(iptables_t)

allow iptables_t self:capability { dac_read_search dac_override

net_admin net_raw }; dontaudit iptables_t self:capability sys_tty_config;
   allow iptables_t self:fifo_file rw_fifo_file_perms;

Quoted 3 lines

Is this for IPv6 ? It was not recommended in NSA security guidelines. Has this now been changed ? If not, then perhaps it can be enclosed in tunable policy ?

No, it happened on systems that didn't use any ip6tables commands.

Quoted 9 lines

Quoted 7 lines · Guido Trentalancia

Quoted 6 lines

+kernel_request_load_module(iptables_t)

allow iptables_t self:capability { dac_read_search dac_override
net_admin net_raw }; dontaudit iptables_t self:capability sys_tty_config; allow iptables_t self:fifo_file rw_fifo_file_perms;

Quoted 5 lines

Quoted 3 lines

Is this for IPv6 ? It was not recommended in NSA security guidelines. Has this now been changed ? If not, then perhaps it can be enclosed in tunable policy ?

No, it happened on systems that didn't use any ip6tables commands.

So, what is the module that it needs to load ?