From: pebenito@ieee.org (Chris PeBenito) Date: Sun, 17 Sep 2017 10:14:19 -0400 Subject: [refpolicy] Chrome patch for discussion In-Reply-To: <20170917041812.GA29152@meriadoc.perfinion.com> References: <20170917032811.b2eyftg5j2wois4n@athena.coker.com.au> <20170917041812.GA29152@meriadoc.perfinion.com> Message-ID: To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On 09/17/2017 12:18 AM, Jason Zaman via refpolicy wrote: > On Sun, Sep 17, 2017 at 01:28:11PM +1000, Russell Coker via refpolicy wrote: >> This patch has been hanging around in my collection for years. I am NOT >> suggesting including it as-is. I am sending it for discussion. >> >> One thing to discuss is whether we use mozilla_t for all browsers (maybe add >> a typealias to browser_t or something) or whether we have a chrome_t. I >> think that having a single mozilla_t or browser_t is the better option but I'm >> not stuck on it. I can rewrite it for a separate chrome_t if that is the >> consensus. > > > We've had a chromium_t in gentoo for quite a while > > https://gitweb.gentoo.org/proj/hardened-refpolicy.git/tree/policy/modules/contrib/chromium.te > https://gitweb.gentoo.org/proj/hardened-refpolicy.git/tree/policy/modules/contrib/chromium.if > https://gitweb.gentoo.org/proj/hardened-refpolicy.git/tree/policy/modules/contrib/chromium.fc > > I kinda like firefox and chromium separate cuz chrome has a bunch of > booleans for chromecast and fido u2f and stuff so then less perms can be > given to FF. > > Also other stuff is that FF can work without execmem if you build with > JIT disabled but chrome wont. > > If we're separating the domains then we can just use the gentoo one > instead of having to re-write. I can send it upstream if its good. > Any comments on it? I didn't look at either of the policies, but I'm fine with chrome having its own domain. -- Chris PeBenito