From:   Russell Coker <russell@coker.com.au>
To:     Chris PeBenito <pebenito@ieee.org>
Reply-To: russell@coker.com.au
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] misc interfaces
Date:   Sun, 06 Jan 2019 12:45:47 +1100
Message-ID: <2720499.UrXOAb4Yr4@xev>
In-Reply-To: <70440b14-0034-f72f-cbb1-f59a39ca67f7@ieee.org>
References: <20190104073312.GA11256@aaa.coker.com.au> <70440b14-0034-f72f-cbb1-f59a39ca67f7@ieee.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Sunday, 6 January 2019 5:39:37 AM AEDT Chris PeBenito wrote:
> On 1/4/19 2:33 AM, Russell Coker wrote:
> > This patch has some small interface changes as well as the policy patches
> > to use the new interfaces.
> > 
> > Index: refpolicy-2.20180701/policy/modules/admin/apt.if
> > ===================================================================
> > --- refpolicy-2.20180701.orig/policy/modules/admin/apt.if
> > +++ refpolicy-2.20180701/policy/modules/admin/apt.if
> > @@ -171,7 +171,7 @@ interface(`apt_read_cache',`
> > 
> > files_search_var($1)
> > allow $1 apt_var_cache_t:dir list_dir_perms;
> > -       allow $1 apt_var_cache_t:file read_file_perms;
> > +       allow $1 apt_var_cache_t:file mmap_read_file_perms;
> > ')
> > 
> > ########################################
> > @@ -191,7 +191,7 @@ interface(`apt_manage_cache',`
> > 
> > files_search_var($1)
> > allow $1 apt_var_cache_t:dir manage_dir_perms;
> > -       allow $1 apt_var_cache_t:file manage_file_perms;
> > +       allow $1 apt_var_cache_t:file { manage_file_perms map };
> > ')
> 
> I dropped these hunks.  In general the map should be a separate
> interface, unless you're arguing that in all cases there should be mmaping.
> 
> Otherwise the remainder is merged.

While it is possible for anyone to write code that manages the apt cache, in 
general anything that touches it will do so via apt utilities or shared 
objects (usually by executing /usr/bin/apt-cache which has bin_t).

Yes I think that in all cases there should be a mapping because in all likely 
cases that will exist (all cases that are known to exist) the same code is 
used for accessing those files.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/