On Tue, 2005-03-01 at 09:35 -0500, Stephen Smalley wrote:
>On Tue, 2005-03-01 at 08:58 -0500, Ivan Gyurdiev wrote:
>> I'd like to mark all role-dependent domains with a new attribute
>> $1_domain (analogous to $1_file_type), and then do the following in
>> base_user_macros.te:
>>
>> can_ps($1, $1_domain)
>> can_ptrace($1, $1_domain)
>>
>> Objections?
>
>can_ptrace? You could easily end up allowing unintended permissions
>directly to the user domain that were previously limited to a specific
>program.

Can you elaborate? I thought can_ptrace was needed for the proper operation of the strace command.

-- 
Ivan Gyurdiev <ivg2@cornell.edu>
Cornell University


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.