Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Russell Coker <russell@coker.com.au>
To:     Dominick Grift <dominick.grift@defensec.nl>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: another memlockd patch
Date:   Fri, 10 Apr 2020 19:40:13 +1000
Message-ID: <1765247.TeHuJhGoBa@liv>
In-Reply-To: <ypjl369bn4ku.fsf@defensec.nl>
References: <20200410060317.GB35896@xev> <ypjl369bn4ku.fsf@defensec.nl>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Friday, 10 April 2020 6:10:57 PM AEST Dominick Grift wrote:
> > +allow memlockd_t self:unix_dgram_socket { create connect };
> 
> the unix dgram socket creating is probably redundant and implied with
> logging_send_logs_msg() as journald uses dgram_sendto for logging?

You are correct, that is redundant.  Chris shall I submit the patch again or 
would it be easier to just delete that line when you merge?

> > +# cache /etc/shadow too
> > +auth_read_shadow(memlockd_t)
> 
> Hmm since /etc/shadow is mode 000, how is memlock able to read this
> without cap_dac_read_search access. is that implied?

/etc/shadow is mode 640 on Debian.

On other distributions the choice is either more permissions for memlockd or a 
configuration that doesn't cache /etc/shadow.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/