Date:   Sat, 13 Apr 2019 09:54:48 +0200
From:   Dominick Grift <dac.override@gmail.com>
To:     Russell Coker <russell@coker.com.au>
Cc:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 3/3] Some items that seem they can be dontaudited for
 plymouthd
Message-ID: <20190413075448.GB5901@brutus.lan>
Mail-Followup-To: Russell Coker <russell@coker.com.au>,
        "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20190412193917.23886-1-dsugar@tresys.com>
 <2319520.MOiGnKPAe5@liv>
 <a539292f-7396-acb3-cb5e-e3415d5cf861@tresys.com>
 <14839769.DdiKdgLD4o@xev>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="1LKvkjL3sHcu1TtY"
Content-Disposition: inline
In-Reply-To: <14839769.DdiKdgLD4o@xev>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--1LKvkjL3sHcu1TtY
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Apr 13, 2019 at 02:24:25PM +1000, Russell Coker wrote:
> On Saturday, 13 April 2019 1:26:06 PM AEST Sugar, David wrote:
> > On 4/12/19 10:33 PM, Russell Coker wrote:
> > > What is netlink_kobject_uevent_socket?  Do we have a place we can doc=
ument
> > > this sort of thing to make it easier to determine whether access is
> > > required and what the implications of such access are?
> >=20
> > I'm really not sure either.  But, please note, that this patch is
> > dontaudit rules to quiet some denials that didn't seem to have any
> > negative side effect.  If this patch isn't applied things will still
> > function, just have some entries in the audit logs.
>=20
> There's a good chance the action in question isn't an accident and some a=
spect=20
> of the program's functionality will be changed.  I think it's best to hav=
e an=20
> idea of what the issue was before putting in a dontaudit rule, if some=20
> configuration of that program actually needs such functionality then a=20
> dontaudit will make it inconvenient to track it down.
>=20
> Have you tried running strace or ltrace to see what it's doing?

I agree that this probably shouldnt be dontaudited. This is a common patter=
n for "udev clients"

The kobject_uevent socket aspect is probably to monitor devices (equivalent=
 to `udevadm monitor`)

>=20
> --=20
> My Main Blog         http://etbe.coker.com.au/
> My Documents Blog    http://doc.coker.com.au/
>=20

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--1LKvkjL3sHcu1TtY
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlyxlcQACgkQJXSOVTf5
R2mrAwwAuNQ5KTB39fVuvsp4bGE0p9Xw/3/tr46OJWxZY2/r+nrOSVxYIDYS7WRm
X9WxGZvDDNHHeNwLDzYEL5XB1Uc97aOJ/3wSwzUYp6vLkYiPbTmpUwrdxpX/HOa0
bJddtBnXUuqOXd5rH3sGsgWEMjqO12FdRbUswBhJMG5OJ2f/qld/aBociLPUArEg
sTmRyYMqByhf5w7F8O4G3bMElwqg1uJiS60VxHtp/I4Sp8Bq6gSLJZsc7G25wWp4
Wiqw8RuMV2p9kHR3LysJwMaAcNSYYDZvEap/+IO4VUiWH4yebTe9LOowEllZNrh0
F5JVB92DwCJw34QmmeW33DfzT71BfkNwo9hODBkrkiUiys01D2Hl1HYegknOSZW1
FrRoJCdIBygnHEH5L4X1egrTQmTG1UBN962sZZ6HgCocYorgJrUtwkjpEWmeBBzR
5hvwGKx/QK/nLI/Bt7QbVoLUXfCHj320I+L3MpWXxdQFWYZAELSTzoNfHe/DxZZF
LMdZ+svu
=kSZC
-----END PGP SIGNATURE-----

--1LKvkjL3sHcu1TtY--