Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] base chrome/chromium patch
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
References: <X/114hdXlO+f4u3Q@xev>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <7fd4bb68-37bf-7b1d-0527-bf515685c7c7@ieee.org>
Date:   Wed, 13 Jan 2021 08:51:19 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.6.0
MIME-Version: 1.0
In-Reply-To: <X/114hdXlO+f4u3Q@xev>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 1/12/21 5:11 AM, Russell Coker wrote:
> This patch is the one I described as "another chromium patch" on the 10th of
> April last year, but with the issues addressed.
> 
> I believe it's ready for inclusion.
> 
> 
> Signed-off-by: Russell Coker <russell@coker.com.au>
> 
> Chromium policy tweaks and DRI policy

[...]

> --- refpolicy-2.20201210.orig/policy/modules/apps/chromium.if
> +++ refpolicy-2.20201210/policy/modules/apps/chromium.if
> @@ -38,7 +38,15 @@ interface(`chromium_role',`
>   
>   	allow $2 chromium_t:process signal_perms;
>   	allow $2 chromium_renderer_t:process signal_perms;
> +	allow $2 chromium_sandbox_t:process signal_perms;
>   	allow $2 chromium_naclhelper_t:process signal_perms;
> +	allow chromium_t $2:process { signull signal };
> +	allow $2 chromium_t:file manage_file_perms;

I think I'm ok with the other parts, but is this a typo, manage on proc/pid entries?


-- 
Chris PeBenito