From:   Russell Coker <russell@coker.com.au>
To:     Chris PeBenito <pebenito@ieee.org>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] some little stuff
Date:   Tue, 15 Jan 2019 18:47:13 +1100
Message-ID: <2480376.JRpnWL4ehX@liv>
In-Reply-To: <4df64def-6cfe-af47-5c2a-dcdbf0d507e4@ieee.org>
References: <20190111103043.GA22910@xev> <4df64def-6cfe-af47-5c2a-dcdbf0d507e4@ieee.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Sunday, 13 January 2019 6:28:35 AM AEDT Chris PeBenito wrote:
> > Index: refpolicy-2.20180701/policy/modules/system/systemd.te
> > ===================================================================
> > --- refpolicy-2.20180701.orig/policy/modules/system/systemd.te
> > +++ refpolicy-2.20180701/policy/modules/system/systemd.te
> > @@ -337,6 +337,10 @@ optional_policy(`
> > networkmanager_dbus_chat(systemd_hostnamed_t)
> > ')
> > 
> > +optional_policy(`
> > +       unconfined_dbus_send(systemd_hostnamed_t)
> > +')
> 
> This comment:
> 
> https://github.com/SELinuxProject/refpolicy/issues/18#issuecomment-452316615
> 
> makes me rethink all dbus sends to unconfined domains, especially
> unconfined_t.  This here isn't all confined domains, but I want more
> consideration for the perm.

That comment is about allowing all domains to send to unconfined_t.  Allowing 
specific domains like systemd_hostnamed_t to send to unconfined_t doesn't seem 
like a problem.  It doesn't seem likely that an attack via dbus would start 
with a systemd domain, especially not one like systemd_hostnamed_t.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/