Subject: Re: what's up with mac_admin
To:     Dominick Grift <dac.override@gmail.com>,
        Russell Coker <russell@coker.com.au>
Cc:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
References: <2502654.FxcCWanWCu@liv> <87ftrtx5p2.fsf@gmail.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <2b937872-7fbd-a3bc-9bcd-b659cf360d04@ieee.org>
Date:   Mon, 11 Mar 2019 20:50:43 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <87ftrtx5p2.fsf@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 3/11/19 2:53 AM, Dominick Grift wrote:
> Russell Coker <russell@coker.com.au> writes:
> 
>> type=AVC msg=audit(1552226284.038:2422): avc:  denied  { mac_admin } for
>> pid=8289 comm="rsync" capability=33
>> scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=capability2
>> permissive=0
> 
> Its for setting invalid labels. Something you generally want to avoid.

Correct.  There used to be a neverallow, but when that was removed, we 
forgot to remove the comment in access_vectors.  It's gone now.


>>
>> The above is from running rsync with the -X option.
>>
>> $ grep -R mac_admin .
>> ./policy/flask/access_vectors:  mac_admin       # unused by SELinux
>> ./policy/modules/apps/livecd.te:dontaudit livecd_t self:capability2 mac_admin;
>>
>> Grepping the git policy shows that there's a comment saying it's unused as
>> well as a dontaudit rule indicating that it has been used for some time.
> 


-- 
Chris PeBenito