Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Russell Coker <russell@coker.com.au>
To:     selinux-refpolicy@vger.kernel.org
Subject: Are we on the wrong track?
Date:   Fri, 12 Jun 2020 10:03:40 +1000
Message-ID: <3243717.6S2XvbbdUs@liv>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

The reference policy is getting an increasing number of domains and types with 
an O(N^2) level of complexity for writing policy and an O(N^2) size of the 
binary policy.  In 2012 the binary policy on my machines was 560k, now it's 
over 2M.

In recent policy we have 6 different domains for systemd-generators.  What 
benefit are we expecting to get from this?  Are we anticipating that one 
generator will attack another?  How would having separate domains for 
generators do any good when there's no restriction on the contents of the 
files they generate and nothing to prevent one generator from creating a file 
of the name that another generator is expected to create?  Is it even 
reasonable to expect that a program that can create a systemd unit file with 
arbitrary content (IE being able to start any daemon with arbitrary 
configuration and command-line parameters) would be unable to exploit that for 
unrestricted root access?

We have a new set of domains, user_wm_t, staff_wm_t, etc.  What is that for?  
Is someone using the X controls and in need of a privileged window manager 
domain to manage the clipboard etc?  Why is staff_wm_t needed when we no 
longer have staff_gpg_t?  Does staff_r even make sense when you could just use 
different MCS categories for different users?

We have one games_t domain for games which were packaged by the distribution.  
Is this possible to give a useful benefit given that they some games the same 
XDG config directories as more important things.  If a game has the file 
access needed to grab passwords from your MUA and network access to send them 
out then is there a real benefit in having a separate domain for it?  As an 
aside I think that the ideal thing to do would be to have a SETGID program to 
manage passwords for email etc that prevents the user from accessing them, it 
could then proxy IMAP/SMTP connections so the MUA never knows the real 
passwords.

We have special *_cronjob_t domains which in systems that use them (IE not 
Debian) seem to give the potential for nothing but confusion.  The general 
expectation is that anything which can run as a user login session can also 
run as a cron job.  What benefit is this expected to provide?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/