-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_files.patch
Fix label of system_map under /boot/efi
Add etc_runtime to hosts.deny
Allow relabel from and to all blk and chr file context. This prevents
restorecon from breaking if users have blk files in homedir.
Add interfaces to rw_all_files
Allow relabel all filesytems to all other files systems (Mount context=)
Add the ability to delete unlabled file (file_t) tmpreaper needs to be
able to delete files left on /tmp that never got labeled on initial label.
A few other interfaces
Additional mount file ssytem. Any file type can be moved to /tmp.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkksdZIACgkQrlYvE4MpobP6LACgyM9okXvx0ZSCaqPl3Zg85rbo
OagAnAxfBw+LhLzj30L6f/cZo6dumzUP
=qK4Y
-----END PGP SIGNATURE-----
On Tue, 2008-11-25 at 17:00 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_files.patch
>
> Fix label of system_map under /boot/efi
>
> Add etc_runtime to hosts.deny
I need justification for this.
> Allow relabel from and to all blk and chr file context. This prevents
> restorecon from breaking if users have blk files in homedir.
Why would there be device nodes in a user home directory? We can't
allow device nodes to be relabeled to something that is not a device
node type.
> Add interfaces to rw_all_files
>
> Allow relabel all filesytems to all other files systems (Mount context=)
When/why did the existing rule for this become insufficient?
> Add the ability to delete unlabled file (file_t) tmpreaper needs to be
> able to delete files left on /tmp that never got labeled on initial label.
I don't have a problem with this, but I think the
files_delete_isid_type_files() interface needs to be split up. Or put
the rules into the purge tmp interface.
> A few other interfaces
Need explanation for the polyinstantiation change.
files_delete_usr_files() needs to be broken up.
> Additional mount file ssytem. Any file type can be moved to /tmp.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Christopher J. PeBenito wrote:
> On Tue, 2008-11-25 at 17:00 -0500, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F11/kernel_files.patch
>>
>> Fix label of system_map under /boot/efi
>>
>> Add etc_runtime to hosts.deny
>
There are some init scripts that modify the hosts.deny file so it ends
up labeled etc_runtime_t. Forget which one.
> I need justification for this.
>
>> Allow relabel from and to all blk and chr file context. This prevents
>> restorecon from breaking if users have blk files in homedir.
>
> Why would there be device nodes in a user home directory? We can't
> allow device nodes to be relabeled to something that is not a device
> node type.
>
Any kernel developer will end up with chr and block devices in their
homedir, if they run a restorecon or setfiles on their home dir they get
avc messages when they relabel their homedir, with "valid" files in the
homedir. Trying to justify this denial, just ends up with kernel
engineers saying SELinux sucks...
>> Add interfaces to rw_all_files
>>
>> Allow relabel all filesytems to all other files systems (Mount context=)
>
> When/why did the existing rule for this become insufficient?
>
If you bind mount files or file systems mount needs to be able to
read/write the source.
>> Add the ability to delete unlabled file (file_t) tmpreaper needs to be
>> able to delete files left on /tmp that never got labeled on initial label.
>
> I don't have a problem with this, but I think the
> files_delete_isid_type_files() interface needs to be split up. Or put
> the rules into the purge tmp interface.
>
Fine.
>> A few other interfaces
>
> Need explanation for the polyinstantiation change.
>
> files_delete_usr_files() needs to be broken up.
>
Fine
>> Additional mount file ssytem. Any file type can be moved to /tmp.
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkk2qD8ACgkQrlYvE4MpobPdKACgoZ6yyvSjrbLoQavDndbQEmML
DU8AoKPX7vhM8puNQgd+kupyiSlu0tkW
=4vtR
-----END PGP SIGNATURE-----