Research
.
Skip Search Box

SELinux Mailing List

Re: can_network patch.

From: James Carter <jwcart2_at_epoch.ncsc.mil>
Date: Fri, 10 Dec 2004 15:23:32 -0500


For now I removed the user_helper stuff in mozilla_macros.te. It causes a compile error if the user_canbe_sysadm tunable is not defined right now anyway.

On Fri, 2004-12-10 at 14:11, Thomas Bleher wrote: 

> * Russell Coker <russell@coker.com.au> [2004-12-10 20:04]:

> > On Saturday 11 December 2004 05:01, Daniel J Walsh <dwalsh@redhat.com> wrote:
> > > Stephen Smalley wrote:
> > > >On Fri, 2004-12-10 at 12:06, Daniel J Walsh wrote:
> > > >>When installing a package within firefox, it attemps to exec
> > > >>system-config-packages which blows up because
> > > >>*-mozilla-t can not run userhelper apps.
> > > >
> > > >Installing a package within firefox? If you are talking about something
> > > >firefox downloaded, then why does it use system-config-packages? And I
> > > >would expect that you would end up installing any such packages local to
> > > >the user's home directory at most (and even then only if policy allows
> > > >writing to it), not on a system-wide basis.
> > >
> > > You can trigger it by executing
> > > firefox selinux-policy-strict-1.19.12-1.src.rpm
> >
> > We have mozilla running in it's own domain to limit the risk of exploits of
> > mozilla taking over the rest of the system. Allowing mozilla to install
> > packages seems to directly contradict this aim.
> >
> > Maybe we should just remove the mozilla policy?
> 
> Or add a boolean to control the transition from the userdomain to
> mozilla. Then we can have a locked down policy for people who just want
> to securely browse the web. People who want all the bells and whistles
> can turn the transition off at the cost of higher exposure.
> 
> Thomas

-- 
James Carter <jwcart2@epoch.ncsc.mil>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
Received on Fri 10 Dec 2004 - 15:21:31 EST
 

Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009

  
bottom
National Security Agency / Central Security Service