Dropping support for disabling caching of context translations (CACHETRANS=0)

Hi,

Recent discussions about performing lazy reading of /etc/selinux/config in libselinux [1] have raised the question of whether some of the optional settings in that file are being used by anyone, as that has an impact on when the config file needs to be processed (i.e. only for functions that operate on policy files or more widely). In particular, the question is whether the CACHETRANS=0 optional setting for disabling caching of context translations by libselinux is in use.

Looking back at the original discussion, it appears that the setting was introduced to allow an admin to disable caching by libselinux for two possible reasons:
- Ensuring freshness in the context translations for long running processes, as there is no cache refresh mechanism presently. This one would be better provided by timeouts or a cache flush mechanism. Or even by a per-process cache disable rather than a global setting for libselinux.
- Enabling "revocation" of access to the context translations in response to a change in policy, since mcstransd does apply permission checks when giving out translations. However, this rationale was rebutted at the time (by me), as the data has already leaked to the client and if the client is going to further provide the data to others in different security contexts, it would be an object manager itself and would have to perform its own security checks.

So, is anyone using CACHETRANS=0? Do we need to retain it going forward in the trunk?

[1] http://marc.theaimsgroup.com/?t=117251719600003&r=1&w=2

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Attaching a patch dropping this config option.

-Steve

____________________________________________________________________________________
Never miss an email again!
Yahoo! Toolbar alerts you the instant new Mail arrives.
http://tools.search.yahoo.com/toolbar/features/mail/

diff -urp libselinux-2.0.4.orig/src/selinux_config.c libselinux-2.0.4/src/selinux_config.c
@@ -17,7 +17,6 @@
 #define SELINUXTAG "SELINUX="
 #define SETLOCALDEFS "SETLOCALDEFS="
 #define REQUIRESEUSERS "REQUIRESEUSERS="
-#define CACHETRANSTAG "CACHETRANS="
 
 /* Indices for file paths arrays. */
 #define BINPOLICY         0

@@ -174,10 +173,6 @@ static void init_selinux_config(void)
 					    sizeof(REQUIRESEUSERS) - 1)) {
 				value = buf_p + sizeof(REQUIRESEUSERS) - 1;
 				intptr = &require_seusers;
-			} else if (!strncmp(buf_p, CACHETRANSTAG,
-					    sizeof(CACHETRANSTAG) - 1)) {
-				value = buf_p + sizeof(CACHETRANSTAG) - 1;
-				intptr = &cache_trans;
 			} else {
 				continue;
 			}

diff -urp libselinux-2.0.4.orig/src/selinux_internal.h libselinux-2.0.4/src/selinux_internal.h
@@ -80,4 +80,3 @@ hidden_proto(selinux_trans_to_raw_contex
 extern int load_setlocaldefs hidden;
 extern int require_seusers hidden;
 extern int selinux_page_size hidden;
-extern int cache_trans hidden;

Thanks, merged on the trunk.

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.