lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 04 Dec 2008 14:32:21 -0500 From: Stephen Smalley <sds@...ho.nsa.gov> To: David Miller <davem@...emloft.net> Cc: adobriyan@...il.com, auke-jan.h.kok@...el.com, akpm@...ux-foundation.org, e1000-devel@...ts.sourceforge.net, netdev@...r.kernel.org, ebiederm@...ssion.com, jmorris@...ei.org, eparis@...isplace.org Subject: Re: [E1000-devel] networking probs in next-20081203 On Thu, 2008-12-04 at 10:21 -0800, David Miller wrote: > From: Stephen Smalley <sds@...ho.nsa.gov> > Date: Thu, 04 Dec 2008 13:11:20 -0500 > > > On Thu, 2008-12-04 at 20:52 +0300, Alexey Dobriyan wrote: > > > On Thu, Dec 04, 2008 at 09:41:24AM -0800, Kok, Auke wrote: > > > > maybe try disabling selinux? > > > > > > This will work. :^) > > > > SELinux didn't change here. /proc/net did. > > We've been through this before... Yep, and we altered SELinux so that they could freely change proc directories into symlinks to support the earlier proc/net change. But now proc/net has turned into its own separate filesystem, with its own filesystem type, which is unknown to SELinux. Thus causing it to be left unlabeled and inaccessible to confined domains. > And it is a usability issue that people can't change how procfs > directories work without requiring the user to update their selinux > policies first. Introducing a new filesystem type (proc/net) without teaching SELinux how to handle it is always going to produce denials on accessing that filesystem. If they left the filesystem type string as "proc" it wouldn't be a problem. Or they can adjust the SELinux code to automagically handle it. Regardless, we didn't break anything. -- Stephen Smalley National Security Agency -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists