Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing ListCleanup of chkpwd and su macros
From: James Carter <jwcart2_at_epoch.ncsc.mil>
Date: Wed, 20 Apr 2005 09:30:15 -0400
Index: macros/program/chkpwd_macros.te RCS file: /nfshome/pal/CVS/selinux-usr/policy/macros/program/chkpwd_macros.te,v retrieving revision 1.15 diff -u -r1.15 chkpwd_macros.te --- macros/program/chkpwd_macros.te 16 Feb 2005 19:40:17 -0000 1.15@@ -17,30 +17,27 @@ # Derived domain based on the calling user domain and the program. type $1_chkpwd_t, domain, privlog, nscd_client_domain, auth;
+role $1_r types $1_chkpwd_t; can_getcon($1_chkpwd_t) can_ypbind($1_chkpwd_t) can_kerberos($1_chkpwd_t) can_ldap($1_chkpwd_t) can_resolve($1_chkpwd_t) -# Transition from the user domain to this domain. + ifelse($1, system, ` domain_auto_trans(auth_chkpwd, chkpwd_exec_t, system_chkpwd_t) -role system_r types system_chkpwd_t; -dontaudit auth_chkpwd shadow_t:file { getattr read }; allow auth_chkpwd sbin_t:dir search; -dontaudit $1_chkpwd_t { user_tty_type tty_device_t }:chr_file rw_file_perms; -can_ypbind(auth_chkpwd) -can_kerberos(auth_chkpwd) -can_ldap(auth_chkpwd) -can_resolve(auth_chkpwd) +allow auth_chkpwd self:netlink_audit_socket create_netlink_socket_perms; +dontaudit system_chkpwd_t { user_tty_type tty_device_t }:chr_file rw_file_perms; +dontaudit auth_chkpwd shadow_t:file { getattr read }; ', ` domain_auto_trans($1_t, chkpwd_exec_t, $1_chkpwd_t) allow $1_t sbin_t:dir search; - -# The user role is authorized for this domain. -role $1_r types $1_chkpwd_t; +allow $1_t self:netlink_audit_socket create_netlink_socket_perms;
# Write to the user domain tty.
Here are the changes to the su macros. user_su_t definitely needs the "allow $1_su_t self:netlink_audit_socket create_netlink_socket_perms;" rule, but now that I look at it again I don't know why I put it in the ifdef. The ifdef is not really needed anyway since chkpwd.te is in domains/program, not domains/program/unused. I don't know why both the domain_auto_trans rule (in su_restricted_domain()) and the can_exec rule (in su_domain() which uses su_restricted_domain()) would be needed. Index: macros/program/su_macros.te RCS file: /nfshome/pal/CVS/selinux-usr/policy/macros/program/su_macros.te,v retrieving revision 1.36 diff -u -r1.36 su_macros.te --- macros/program/su_macros.te 10 Mar 2005 21:07:51 -0000 1.36@@ -32,7 +32,6 @@ domain_auto_trans($1_t, su_exec_t, $1_su_t)
allow $1_su_t sbin_t:dir search;
uses_shlib($1_su_t)
define(`su_mini_domain', `
define(`su_domain', `
-ifdef(`chkpwd.te', ` -# Run chkpwd. -can_exec($1_su_t, chkpwd_exec_t) -') # Inherit and use descriptors from gnome-pty-helper. ifdef(`gnome-pty-helper.te', `allow $1_su_t $1_gph_t:fd use;') -- James Carter <jwcart2@epoch.ncsc.mil> National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Wed 20 Apr 2005 - 09:34:07 EDT |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |