Subject: Re: [PATCH] some little stuff
To:     Russell Coker <russell@coker.com.au>
Cc:     selinux-refpolicy@vger.kernel.org
References: <20190111103043.GA22910@xev>
 <4df64def-6cfe-af47-5c2a-dcdbf0d507e4@ieee.org> <2480376.JRpnWL4ehX@liv>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <34bdee18-433e-5e8e-088e-6c209d70fa37@ieee.org>
Date:   Wed, 16 Jan 2019 18:04:32 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <2480376.JRpnWL4ehX@liv>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 1/15/19 2:47 AM, Russell Coker wrote:
> On Sunday, 13 January 2019 6:28:35 AM AEDT Chris PeBenito wrote:
>>> Index: refpolicy-2.20180701/policy/modules/system/systemd.te
>>> ===================================================================
>>> --- refpolicy-2.20180701.orig/policy/modules/system/systemd.te
>>> +++ refpolicy-2.20180701/policy/modules/system/systemd.te
>>> @@ -337,6 +337,10 @@ optional_policy(`
>>> networkmanager_dbus_chat(systemd_hostnamed_t)
>>> ')
>>>
>>> +optional_policy(`
>>> +       unconfined_dbus_send(systemd_hostnamed_t)
>>> +')
>>
>> This comment:
>>
>> https://github.com/SELinuxProject/refpolicy/issues/18#issuecomment-452316615
>>
>> makes me rethink all dbus sends to unconfined domains, especially
>> unconfined_t.  This here isn't all confined domains, but I want more
>> consideration for the perm.
> 
> That comment is about allowing all domains to send to unconfined_t.  Allowing
> specific domains like systemd_hostnamed_t to send to unconfined_t doesn't seem
> like a problem.  It doesn't seem likely that an attack via dbus would start
> with a systemd domain, especially not one like systemd_hostnamed_t.

It's applicable to confined domains sending messages to unconfined 
domains.  What compounds my concern is that there is no similar access 
for confined users, so where is this coming from? (what's happening?)

-- 
Chris PeBenito