Messages in this thread | | | Subject | Re: [PATCH 08/28] SECURITY: Allow kernel services to override LSM settings for task actions [try #2] | From | Stephen Smalley <> | Date | Wed, 12 Dec 2007 14:49:06 -0500 |
| |
On Wed, 2007-12-12 at 11:44 -0800, Casey Schaufler wrote: > --- David Howells <dhowells@redhat.com> wrote: > > > Casey Schaufler <casey@schaufler-ca.com> wrote: > > > > > What sort of authorization are you thinking of? I would expect > > > that to have been done by cachefileselinuxcontext (or > > > cachefilesspiffylsmcontext) up in userspace. If you're going to > > > rely on userspace applications for policy enforcement they need > > > to be good enough to count on after all. > > > > It can't be done in userspace, otherwise someone using the cachefilesd > > interface can pass an arbitrary context up. > > Yes, but I would expect that interface to be protected (owned by root, > mode 0400). If /dev/cachefiles has to be publicly accessable make it > a privileged ioctl.
Uid 0 != CAP_MAC_OVERRIDE if you configure file caps and such.
> > The security context has to be > > passed across the file descriptor attached to /dev/cachefiles along with the > > other configuration parameters as a text string. > > I got that. > > > This fd selects the > > particular cache context that a particular instance of a running daemon is > > using. > > Yes, but forgive me being slow, I don't see the problem. > > > Casey Schaufler > casey@schaufler-ca.com -- Stephen Smalley National Security Agency
| |