There are quite a few modules that call foo_run() or foo_exec() inside
their admin interface. Previously some were removed because they caused
problems if both the _admin and _run interface are added to a role but
some still remain.
In the previous patch [1] that added all the rest of the admin
interfaces, some new things now have a transition in _run. eg,
rsync_admin was added which currently calls rsync_run, so sysadm using
rsync has a transition when previously it did not.
Should I send a patch to remove them? and if yes, remove all or remove
only the _run and leave the _exec?
Also do you want a patch to add the removed interfaces back to sysadm.te
directly? Or only add the ones that were there before patch [1]?
[1]: http://oss.tresys.com/pipermail/refpolicy/2015-June/007660.html
On 7/16/2015 9:44 AM, Jason Zaman wrote:
> There are quite a few modules that call foo_run() or foo_exec() inside
> their admin interface. Previously some were removed because they caused
> problems if both the _admin and _run interface are added to a role but
> some still remain.
>
> In the previous patch [1] that added all the rest of the admin
> interfaces, some new things now have a transition in _run. eg,
> rsync_admin was added which currently calls rsync_run, so sysadm using
> rsync has a transition when previously it did not.
>
> Should I send a patch to remove them? and if yes, remove all or remove
> only the _run and leave the _exec?
>
> Also do you want a patch to add the removed interfaces back to sysadm.te
> directly? Or only add the ones that were there before patch [1]?
I think that in general, the concept for admin interfaces can include
the run calls, assuming it is needed to perform the admin tasks.
--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com