Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [RFC] files: Make files_{relabel,manage}_non_security_types work
 on all file types
To:     Henrik Grindal Bakken <hgb@ifi.uio.no>
Cc:     selinux-refpolicy@vger.kernel.org
References: <20200117231500.59904-1-hgb@ifi.uio.no>
 <aee925e5-1a1f-1c97-71eb-669ff5890392@ieee.org> <875zh4aop3.fsf@cisco.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <068afebc-bee1-0d1e-ed37-e1473f66f982@ieee.org>
Date:   Wed, 22 Jan 2020 05:03:06 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.3.1
MIME-Version: 1.0
In-Reply-To: <875zh4aop3.fsf@cisco.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 1/21/20 9:06 AM, Henrik Grindal Bakken wrote:
> Chris PeBenito <pebenito@ieee.org> writes:
> 
>> On 1/17/20 6:15 PM, Henrik Grindal Bakken wrote:
>>> From: Henrik Grindal Bakken <henribak@cisco.com>
>>>
>>> This is the same behavious as files_*_non_auth_types have.
> 
> [...]
> 
>> NAK.  Access per object class is already split up across separate
>> interfaces, so doing this would be confusing and prevent someone from
>> getting file-only access.
> 
> Ok.  Then I would recomment rewriting the systemd_tmpfiles_t rules a
> bit, because today it has a serious amount of AVC violations for pretty
> standard usage.

Perhaps.  However, it depends on what you consider standard usage.


> There are no matching interfaces for lnk_files, at least.  Any
> suggestions as to how to set up the tmpfiles rules?

By adding new interfaces that are like the existing 
files_manage_non_security_files() interface, but for lnk_file.


-- 
Chris PeBenito