Subject: Re: [PATCH] chrome/chromium
To:     russell@coker.com.au
Cc:     selinux-refpolicy@vger.kernel.org
References: <20190108084939.GA28652@xev>
 <f4be7e95-9b5d-985d-3033-6faec99e2742@ieee.org> <11639347.phjdDo44MW@xev>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <857d83a0-1aba-6e03-59fb-f1c6b451452c@ieee.org>
Date:   Thu, 10 Jan 2019 20:17:36 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <11639347.phjdDo44MW@xev>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 1/10/19 12:17 AM, Russell Coker wrote:
> On Thursday, 10 January 2019 11:06:23 AM AEDT Chris PeBenito wrote:
>>> allow $2 mozilla_t:fd use;
>>> allow $2 mozilla_t:shm rw_shm_perms;
>>> +       allow chrome_sandbox_t $2:fd use;
>>> +       allow chrome_sandbox_t $2:fifo_file write;
>>> +       allow chrome_sandbox_t $3:chr_file { read write };
>>
>> Beyond that, this simply won't fly because all the seemingly conflicting
>> types.  A user might think, "what does mozilla have to do with chrome? I
>> don't even have mozilla installed!"  For this to work, we'd have to go
>> down a generic browser policy, with correspondingly generic type names.
>> I'm not opposed to this, but that'd be the first step.
> 
> Fair point.  Would you like me to submit a patch s/mozilla/webbrowser/g as the
> first step towards this?

Sure.  Don't forget the compat aliases for mozilla.

-- 
Chris PeBenito