• Ivan Gyurdiev <ivg2@cornell.edu> [2005-03-01 15:30]:
  > I'd like to mark all role-dependent domains with a new attribute
  > $1_domain (analogous to $1_file_type), and then do the following in
  > base_user_macros.te:
  >
  > can_ps($1, $1_domain)
  > can_ptrace($1, $1_domain)
  >
  > Objections?
  

Yes. can_ps() might be OK, but can_ptrace() is too much. With ptrace, users have complete control over derived domains. I do not think we want that. An example: I'd like to have a version of gpg without --export-secret-keys. Together with SELinux it then becomes very hard to steal the secret key, even from a compromised program in user_t. Your change would compromise this.
I'd be more OK with
 can_ps($1_t, $1_domain)
 allow $1_t $1_domain:process signal;
because the signal permission is very inconsistently used right now and is sometimes needed to kill misbehaving programs.

Thomas

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



application/pgp-signature attachment: stored