Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sat, 15 Jun 2019 21:43:48 +0200
From:   Dominick Grift <dac.override@gmail.com>
To:     Chris PeBenito <pebenito@ieee.org>
Cc:     Alexander Miroshnichenko <alex@millerson.name>,
        selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] add lldpd policy
Message-ID: <20190615194348.GB2818@brutus.lan>
Mail-Followup-To: Chris PeBenito <pebenito@ieee.org>,
        Alexander Miroshnichenko <alex@millerson.name>,
        selinux-refpolicy@vger.kernel.org
References: <20190610142004.2719-1-alex@millerson.name>
 <749388e0-6da1-4b06-c62c-35302a5aba78@ieee.org>
 <20190615175859.GA2818@brutus.lan>
 <3d0d13b8-3090-558e-23b6-7edaeeff3f92@ieee.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="cmJC7u66zC7hs+87"
Content-Disposition: inline
In-Reply-To: <3d0d13b8-3090-558e-23b6-7edaeeff3f92@ieee.org>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--cmJC7u66zC7hs+87
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Jun 15, 2019 at 03:24:03PM -0400, Chris PeBenito wrote:
> On 6/15/19 1:58 PM, Dominick Grift wrote:
> > On Sat, Jun 15, 2019 at 12:08:16PM -0400, Chris PeBenito wrote:
> > > On 6/10/19 10:20 AM, Alexander Miroshnichenko wrote:
>=20
> > > > +allow lldpd_t self:process { fork signal_perms };
> > > > +allow lldpd_t self:fifo_file rw_fifo_file_perms;
> > > > +allow lldpd_t self:unix_stream_socket { accept listen };
> > >=20
> > > These perms should probably be create_stream_socket_perms.
> >=20
> > the other permissions are already provided with logging_send_syslog_msg=
() so would be reduntant
>=20
> This is true.  However,the syslog socket is not the only socket in use.
> Since it also listens on its own stream socket, the
> create_stream_socket_perms more clearly shows the intent.

The compiler will remove the duplicate rules, and yes the intent is more cl=
ear.
It just feels strange writing and reading duplicate policy.

>=20
>=20
> --=20
> Chris PeBenito

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--cmJC7u66zC7hs+87
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl0FSm8ACgkQJXSOVTf5
R2mO+Av/f+4AsXpaH3QWN6JIorar8oHHPiBA50SFAoiy3YkREpVeUQr179geWo9W
AN8S0x826+QufYRUgiwX6wBExQ9gg6YU6B2ZC0dJaFK5ad9ys1Enele/fYTovIuV
HTiaKVULWtZrb4mGNqwo7YPM6dhrpHapIAysZ8I1NcbFBNS5YCS5mj3yP6zjEtzY
PT5opCqj2MOQRKoDhFSqV2NXcV6Q8ipEmscDujvcOYs7yW+YOWFphW1OFp3X7Km4
cSIem1snpcIdT+6jCcUQAYLqK1XdpbP6AbPfox5APNiAE/A5sK+vAznCVJ0AP8pd
9kRA5pqeHqYc+5ke1u+nJRPN2Vdsq618qDdD9UDFJ/ATGemhH3qKEYGrtO6AzWbp
eA26p+GhPEYlLFk3NELso1V0VcEZUS2v78sWZ6Y5VmX4QUrM2xncP94Xzosh5N55
par+KsrJZvTlXSVgFfqIK6PsydMZSwupU7O+tNZizF2e5fpFkbsmJ4ymtlfx/oyi
2ibe4ZJ4
=wSN1
-----END PGP SIGNATURE-----

--cmJC7u66zC7hs+87--