Re: modification of vixie-cron patch to get crond working in permissive mode

On Thu, 2004-01-01 at 11:05, Arkadiusz Miskiewicz wrote:
> This patch should be applied after fedora core selinux patch for vixie-cron
> (probably the same as on nsa.gov/selinux page).
>
> It changes behaviour when running selinux in permissive mode. Until now when
> there were no known context with which jobs should be executed then error
> message was logged and crontab file was skipped. Now error message is logged
> but jobs are still run.
>
> It's better to have working crond + bunch of log messages instead of not
> usable crond.
>
> Please apply + rediff new selinux patch.

I doubt that we want to fork the error handling on each operation into separate cases for enforcing vs. permissive. The only case where this might be reasonable is the entrypoint permission check, since this is essentially emulating a kernel check in userspace to deal with the fact that crontab files are not directly executed. In the future, I would expect this to be encapsulated in the userspace AVC, so that the application code can just call avc_has_perm, and the AVC will internally check the enforcing flag and handle it, as in the kernel.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.