Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Russell Coker <russell@coker.com.au>
To:     Dominick Grift <dominick.grift@defensec.nl>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] misc apps and admin patches
Date:   Thu, 21 Jan 2021 10:18:11 +1100
Message-ID: <38369021.nZfMU4C0An@liv>
In-Reply-To: <ypjlh7nblkb2.fsf@defensec.nl>
References: <YAgCC7ngI/WrlxMR@xev> <10140498.mdnUOP6vMp@liv> <ypjlh7nblkb2.fsf@defensec.nl>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Precedence: bulk

On Thursday, 21 January 2021 2:06:25 AM AEDT Dominick Grift wrote:
> >> Can you explain why you added this?
> > 
> > Apart from the obvious that some program wanted it, no.  I'll remove that
> > bit and add it again with a note if it's necessary.  Did you like the
> > rest of that patch?
> 
> Yes and thats my beef with this. "some program wanted it". sysadm_t is a
> shell domain. Any programs that need this should, in my view, ideally be
> targeted. If you dont want that then use unconfined_t instead and be
> done.
> 
> I dont want sysadm_t to become a "drunken unconfined_t".

Fair point.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/