Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: Are we on the wrong track?
To:     Russell Coker <russell@coker.com.au>
Cc:     selinux-refpolicy@vger.kernel.org
References: <3243717.6S2XvbbdUs@liv>
 <578d7c7c-cb41-b224-2758-144aa9b5c1ad@ieee.org> <2469682.qIgoumM3a6@liv>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <9fb12224-d7d7-3156-e25b-2bf4c37266b5@ieee.org>
Date:   Mon, 15 Jun 2020 09:52:43 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.8.0
MIME-Version: 1.0
In-Reply-To: <2469682.qIgoumM3a6@liv>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 6/12/20 9:02 AM, Russell Coker wrote:
> On Friday, 12 June 2020 10:52:56 PM AEST Chris PeBenito wrote:
>>> In recent policy we have 6 different domains for systemd-generators.  What
>>> benefit are we expecting to get from this?  Are we anticipating that one
>>> generator will attack another?  How would having separate domains for
>>> generators do any good when there's no restriction on the contents of the
>>> files they generate and nothing to prevent one generator from creating a
>>> file of the name that another generator is expected to create?  Is it
>>> even reasonable to expect that a program that can create a systemd unit
>>> file with arbitrary content (IE being able to start any daemon with
>>> arbitrary configuration and command-line parameters) would be unable to
>>> exploit that for unrestricted root access?
>>
>> I find this a valid criticism and reason enough to at least collapse them
>> into a single domain.  The original intent was to constrain the special
>> access they use, but you are correct, a compromised generator could do
>> mostly do all the bad things anyway since it can write unit files.
> 
> OK, I'll submit a patch for that.

There were a few pending PRs that were put on hold or dropped for this change of 
direction, so I've posted the change:

https://github.com/SELinuxProject/refpolicy/pull/276

-- 
Chris PeBenito