Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] cockpit web admin system
To:     Dominick Grift <dominick.grift@defensec.nl>,
        Russell Coker <russell@coker.com.au>
Cc:     selinux-refpolicy@vger.kernel.org,
        Matej Marusak <mmarusak@redhat.com>
References: <YH6gq6yWUmo93KT7@xev> <ypjlbla9f4mk.fsf@defensec.nl>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <574c5faf-0c19-8b9a-3bfe-a71d82a1f2e6@ieee.org>
Date:   Mon, 26 Apr 2021 08:47:27 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.8.1
MIME-Version: 1.0
In-Reply-To: <ypjlbla9f4mk.fsf@defensec.nl>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 4/20/21 9:49 AM, Dominick Grift wrote:
> Russell Coker <russell@coker.com.au> writes:
> 
>> I took this from the rawhide policy and adapted it to work with refpolicy.
>>
>> Probably not ready for merging yet, let me know what should be changed.
> 
> Its been a while since I played with cockpit
> 
> Theres one thing that I want to mention though, instead of login the
> confined users in with their login shell domain consider confining the
> cockpit-bridge instead and make it log users in with bridge context
> instead of the login shell context.

Do you have an example of permissions that would be concerning?


> Because otherwise you'll end up extending the login shell domain with
> permissions needed by the bridge. You can still allow the bridge to open
> up a shell with a transition back to the login shell domain (but then
> you will get into domain prefixes
> 
> ie: staff_bridge_t -> shell_exec_t -> staff_t vs. user_bridge_t ->
> shell_exec_t -> user_t etc.


Otherwise I only see some style cleanup needed.  Also there is an optional block 
in the admin interface for systemd calls.  Systemd is required for cockpit, so 
it shouldn't be optional, right?

-- 
Chris PeBenito