Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Dominick Grift <dominick.grift@defensec.nl>
To:     Russell Coker <russell@coker.com.au>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] misc apps and admin patches
References: <YAgCC7ngI/WrlxMR@xev> <ypjl5z3rn3e6.fsf@defensec.nl>
        <10140498.mdnUOP6vMp@liv>
Date:   Wed, 20 Jan 2021 16:06:25 +0100
In-Reply-To: <10140498.mdnUOP6vMp@liv> (Russell Coker's message of "Thu, 21
        Jan 2021 00:36:04 +1100")
Message-ID: <ypjlh7nblkb2.fsf@defensec.nl>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

Russell Coker <russell@coker.com.au> writes:

> On Thursday, 21 January 2021 12:28:49 AM AEDT Dominick Grift wrote:
>> > optional_policy(`
>> > +       init_dbus_chat(sysadm_t)
>> 
>> Can you explain why you added this?
>
> Apart from the obvious that some program wanted it, no.  I'll remove that bit 
> and add it again with a note if it's necessary.  Did you like the rest of that 
> patch?

Yes and thats my beef with this. "some program wanted it". sysadm_t is a
shell domain. Any programs that need this should, in my view, ideally be
targeted. If you dont want that then use unconfined_t instead and be
done.

I dont want sysadm_t to become a "drunken unconfined_t".

-- 
gpg --locate-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098
Dominick Grift