Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
To:     selinux-refpolicy@vger.kernel.org
From:   Topi Miettinen <toiwoton@gmail.com>
Subject: Access to raw memory: remove or make boolean?
Message-ID: <11011d01-844e-c526-a85f-92a7fc985d16@gmail.com>
Date:   Mon, 24 Feb 2020 17:11:46 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.5.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

Hi,

I made a PR 192 (https://github.com/SELinuxProject/refpolicy/pull/192) 
for introducing a new boolean to disable access to raw memory devices 
(/dev/mem, /dev/kmem, /dev/mergemem, dev/oldmem, /dev/port) because on 
modern systems, direct access shouldn't be needed anymore. Chris 
PeBenito asked to propose to this list whether instead of boolean, the 
access should be removed unconditionally if it's no longer needed. I 
think boolean could be useful for those systems where this is still 
needed but still use latest reference policy.

-Topi Miettinen