new and improved range_transition statements
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest2 patches 48 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | kernel support for new range_transition statementssecurity/ security/ security/ +1 more | +0 | 2 replies | |
| 2/2 | userland support for new range_transition statementsinclude/ include/ module_compiler.c +7 more | +0 | 24 replies |
Reviews trailers per patch
1 of 2 patches has a Reviewed-by or Acked-by.
| Patch | Stephen Smalley | James Morris |
|---|---|---|
| 1/2 | A-b | A-b |
| 2/2 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH 0/2] new and improved range_transition statements
This following patches allow for specification of security classes for range_transition statements in the policy. This is intended to address a solution for RedHat Bugzilla #185436.
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=185436
While working on this format change to allow class specification, it was noted that the current range_transition handling in the policy toolchain was not ideal. It expanded things at compile time and there was no way to get these statements into policy modules. So, in addition to changing the kernel policy format and base policy format in a trivial manner to support the desired functionality, I also tried to make the base and module formats more robust when handling range_transition rules. Hopefully, this format will allow for range_transition statements in modules with additional work for libsepol in the (near?) future. I will defer the toolchain gurus on the completeness of my approach ;) This patch set has been tested in the following configurations:
old kernel / all old policy - sure glad that worked
old kernel / old format modules generating a new format kernel policy that
is automatically downgraded at load time
old kernel / new format modules generating a new format kernel policy that
is automatically downgraded at load time
new kernel / old format modules generating a new format kernel policy old kernel / new format modules generating a new format kernel policy
The old style statements (without class specification) are correctly interpreted as applying to the "process" class. Old and new style statements can be used together happily. Duplicate and conflicting rules are properly handled when expanding the rules with dups being dropped and conflicts resulting in an error. Also, a kernel policy that contains range_transitions for classes other than "process" will have those transition rules dropped when it is downgraded, but all "process" rules will remain as the old format supports them.
The kernel change is fairly simple. Sure would be nice to get that into 2.6.18 since it is for a bug fix...
The toolchain changes are a bit more complex, although it sure seems a lot easier than it did when I started looking at the code. I'd appreciate some scrutiny of this, especially in the area of future support for range_transition statements in policy modules. I feel that will be very necessary and I hope to ease that path with the format change.
Signature · 6 lines
Darrel -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.