2016-10-29 16:08:18

by guido

Subject: [refpolicy] [PATCH] Let unprivileged users list mounted filesystems

Let unprivileged users list filesystems mounted on mount points such
as /mnt (cdrom, FAT, NTFS and so on).

This makes a great difference to the usability and effectiveness of
graphical filesystem browsers such as Gnome Nautilus and currently
comes at no security penalty because mounted filesystems can be
listed with programs such as the "df" program from GNU coreutils or
by simply reading /proc/mounts.

Signed-off-by: Guido Trentalancia <[email protected]>
---
policy/modules/system/userdomain.if | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff -pruN refpolicy-git-29102016-orig/policy/modules/system/userdomain.if refpolicy-git-29102016/policy/modules/system/userdomain.if
--- refpolicy-git-29102016-orig/policy/modules/system/userdomain.if 2016-09-09 17:23:54.956287179 +0200
+++ refpolicy-git-29102016/policy/modules/system/userdomain.if 2016-10-29 16:44:56.343046029 +0200
@@ -530,8 +530,8 @@ template(`userdom_common_user_template',

files_exec_etc_files($1_t)
files_search_locks($1_t)
- # Check to see if cdrom is mounted
- files_search_mnt($1_t)
+ # List mounted filesystems (cdrom, FAT, NTFS and so on)
+ files_list_mnt($1_t)
# cjp: perhaps should cut back on file reads:
files_read_var_files($1_t)
files_read_var_symlinks($1_t)

2016-10-30 18:32:10

by Chris PeBenito

Subject: [refpolicy] [PATCH] Let unprivileged users list mounted filesystems

On 10/29/16 12:08, Guido Trentalancia via refpolicy wrote:
> Let unprivileged users list filesystems mounted on mount points such
> as /mnt (cdrom, FAT, NTFS and so on).
>
> This makes a great difference to the usability and effectiveness of
> graphical filesystem browsers such as Gnome Nautilus and currently
> comes at no security penalty because mounted filesystems can be
> listed with programs such as the "df" program from GNU coreutils or
> by simply reading /proc/mounts.
>
> Signed-off-by: Guido Trentalancia <[email protected]>
> ---
> policy/modules/system/userdomain.if | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff -pruN refpolicy-git-29102016-orig/policy/modules/system/userdomain.if refpolicy-git-29102016/policy/modules/system/userdomain.if
> --- refpolicy-git-29102016-orig/policy/modules/system/userdomain.if 2016-09-09 17:23:54.956287179 +0200
> +++ refpolicy-git-29102016/policy/modules/system/userdomain.if 2016-10-29 16:44:56.343046029 +0200
> @@ -530,8 +530,8 @@ template(`userdom_common_user_template',
>
> files_exec_etc_files($1_t)
> files_search_locks($1_t)
> - # Check to see if cdrom is mounted
> - files_search_mnt($1_t)
> + # List mounted filesystems (cdrom, FAT, NTFS and so on)
> + files_list_mnt($1_t)
> # cjp: perhaps should cut back on file reads:
> files_read_var_files($1_t)
> files_read_var_symlinks($1_t)

Merged.

--
Chris PeBenito