From: "Sven Vermeulen" <swift@gentoo.org> To: gentoo-commits@lists.gentoo.org Subject: [gentoo-commits] proj/hardened-refpolicy:testing commit in: policy/modules/kernel/ Date: Wed, 6 Aug 2014 18:13:13 +0000 (UTC) [thread overview] Message-ID: <1407348517.a3557731110822effbdd433dffe24c3fbacdc9d8.swift@gentoo> (raw) commit: a3557731110822effbdd433dffe24c3fbacdc9d8 Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be> AuthorDate: Wed Aug 6 08:55:58 2014 +0000 Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> CommitDate: Wed Aug 6 18:08:37 2014 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a3557731 Comment out seutil_relabelto_bin_policy We comment out the use of the seutil_relabelto_bin_policy call in the files_relabel_non_auth_files interface. This allows us to set this interface in a tunable statement, like so: seutil_relabelto_bin_policy(foo_t) tunable_policy(`foo_relabel_non_auth_files',` files_relabel_non_auth_files(foo_t) ') In larger entries, this allows us to have a minimalistic policy (a domain only allowed to manage and relabel a certain set of file types) and, through a boolean, enable it to manage and relabel a larger set of types. --- policy/modules/kernel/files.if | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 3f20525..ca278d5 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1445,7 +1445,9 @@ interface(`files_relabel_non_auth_files',` relabelfrom_chr_files_pattern($1, non_auth_file_type, non_auth_file_type) # satisfy the assertions: - seutil_relabelto_bin_policy($1) + # seutil_relabelto_bin_policy($1) + # Gentoo: this is removed as we do not want to set attributes in this phase, we want + # to allow files_relabel_non_auth_files to be an optional setting (tunable). ')
WARNING: multiple messages have this Message-ID (diff)
From: "Sven Vermeulen" <swift@gentoo.org> To: gentoo-commits@lists.gentoo.org Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/ Date: Thu, 7 Aug 2014 08:06:03 +0000 (UTC) [thread overview] Message-ID: <1407348517.a3557731110822effbdd433dffe24c3fbacdc9d8.swift@gentoo> (raw) Message-ID: <20140807080603.pcz6GEn7zhdhR57AuwN99N4khSVOBFer2Hh4hMVfLlE@z> (raw) commit: a3557731110822effbdd433dffe24c3fbacdc9d8 Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be> AuthorDate: Wed Aug 6 08:55:58 2014 +0000 Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> CommitDate: Wed Aug 6 18:08:37 2014 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a3557731 Comment out seutil_relabelto_bin_policy We comment out the use of the seutil_relabelto_bin_policy call in the files_relabel_non_auth_files interface. This allows us to set this interface in a tunable statement, like so: seutil_relabelto_bin_policy(foo_t) tunable_policy(`foo_relabel_non_auth_files',` files_relabel_non_auth_files(foo_t) ') In larger entries, this allows us to have a minimalistic policy (a domain only allowed to manage and relabel a certain set of file types) and, through a boolean, enable it to manage and relabel a larger set of types. --- policy/modules/kernel/files.if | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 3f20525..ca278d5 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1445,7 +1445,9 @@ interface(`files_relabel_non_auth_files',` relabelfrom_chr_files_pattern($1, non_auth_file_type, non_auth_file_type) # satisfy the assertions: - seutil_relabelto_bin_policy($1) + # seutil_relabelto_bin_policy($1) + # Gentoo: this is removed as we do not want to set attributes in this phase, we want + # to allow files_relabel_non_auth_files to be an optional setting (tunable). ')
next reply other threads:[~2014-08-06 18:13 UTC|newest] Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top 2014-08-06 18:13 Sven Vermeulen [this message] 2014-08-07 8:06 ` [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/ Sven Vermeulen -- strict thread matches above, loose matches on Subject: below -- 2014-08-08 8:50 [gentoo-commits] proj/hardened-refpolicy:testing " Sven Vermeulen 2014-08-08 8:50 Sven Vermeulen 2014-08-08 8:48 [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen 2014-08-08 8:50 ` [gentoo-commits] proj/hardened-refpolicy:testing " Sven Vermeulen 2014-08-07 12:41 Sven Vermeulen 2014-08-07 12:41 Sven Vermeulen 2014-08-07 12:30 Sven Vermeulen 2014-08-07 9:41 [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen 2014-08-08 8:50 ` [gentoo-commits] proj/hardened-refpolicy:testing " Sven Vermeulen 2014-08-06 18:13 Sven Vermeulen 2014-08-06 9:06 Sven Vermeulen 2014-08-06 8:59 Sven Vermeulen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1407348517.a3557731110822effbdd433dffe24c3fbacdc9d8.swift@gentoo \ --to=swift@gentoo.org \ --cc=gentoo-commits@lists.gentoo.org \ --cc=gentoo-dev@lists.gentoo.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox