lkml.org 
[lkml]   [2007]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 08/28] SECURITY: Allow kernel services to override LSM settings for task actions [try #2]
    From
    Date
    On Thu, 2007-12-13 at 15:36 +0000, David Howells wrote:
    > Stephen Smalley <sds@tycho.nsa.gov> wrote:
    >
    > > It is just a way of carving up the permission space, typically based on
    > > object type, but it can essentially be arbitrary. The check in this
    > > case seems specific to cachefiles since it is controlling an operation
    > > on the /dev/cachefiles interface that only applies to cachefiles
    > > internal operations, so making a cachefiles class seems reasonable.
    >
    > Can you specify what sort of permissions you're thinking of providing for
    > tasks to operate on this class?

    They would correspond with the operations provided by
    the /dev/cachefiles interface, at the granularity you want to support
    distinctions to be made. Could just be a single 'setcontext' permission
    if that is all you want to control distinctly, or could be a permission
    per operation.

    > Can an object of this class 'operate' on
    > other objects, or can only process-class objects do that?

    In this case, I wouldn't expect a cachefiles object to act on anything
    else. Some objects are also used as subjects, especially in the
    networking arena.

    > How does an object of this class acquire a label? What is an object of this
    > class? Is it a "cache"? Or were you thinking of a "module"?

    I was thinking the latter since the only goal was to control what
    contexts could be set by a given task, but you could support per-cache
    "objects" with their own labels (in which case the label would likely be
    determined from the creating task).

    If the latter, you don't really need a label for the object, and can
    just use the supplied context/secid as the object of the permission
    check, ala:
    rc = avc_has_perm(tsec->sid, secid, SECCLASS_CACHEFILES,
    CACHEFILES__SETCONTEXT);

    If the former, then you'd need more than one check, as you then have to
    check whether the task can act on the cache in question, and then check
    whether it can set the context for that cache to the specified value.

    --
    Stephen Smalley
    National Security Agency



    \
     
     \ /
      Last update: 2007-12-13 17:29    [W:3.695 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site