Re: Proposed policy feature: $1_domain attribute

> > How about a: $1_constrained attribute.
> >
> > Then we can do:
> > can_ps($1, $1_constrained)
> > can_ptrace($1, $1_constrained)
> > allow $1 $1_constrained:process signal;
>
> I think I'd prefer a macro that can be selectively included by program
> domains that have been identified as being suitable for complete control
> by the user (but if you are allowing ptrace, then you might as well
> allow all signals, including sigkill and sigstop).

I am starting to give up on this idea - it's not going to work. Programs have too many private things that should not be exposed to user_t for no good reason. I thought there were going to be lots of user-restricted domains, but that's not so - most of them do something special that user can't currently do. Seems better to just make the current permissions more consistent throughout the policy without additional macros.

-- 
Ivan Gyurdiev <ivg2@cornell.edu>
Cornell University


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.