Re: [AppArmor 01/41] Pass struct vfsmount to the inode_create LSM hook

[Valdis . Kletnieks]

On Sat, 26 May 2007 22:10:34 EDT, Kyle Moffett said:
> On May 26, 2007, at 19:08:56, Toshiharu Harada wrote:

> > (1) Object labeling has a assumption that labels are always  
> > properly defined and maintained. This can not be easily achieved.
> 
> That's a circular argument, and a fairly trivial one at that.  If you  
> can't properly manage your labels, then how do you expect any  
> security at all? 

Unfortunately, it's not at all as simple as all that. Toshiharu is quite
correct that it isn't always easy to actually implement.  Consider how
many ad-croc usages of 'restorecon' are needed to get a Fedora SELinux box
through rc.sysinit:

% grep restorecon /etc/rc.sysinit
if [ -n "$SELINUX_STATE" -a -x /sbin/restorecon ] && LC_ALL=C fgrep -q " /dev " /proc/mounts ; then
        /sbin/restorecon  -R /dev 2>/dev/null
    REBOOTFLAG=`restorecon -v /sbin/init`
[ -n "$SELINUX_STATE" ] && restorecon /dev/pts >/dev/null 2>&1
[ -n "$SELINUX_STATE" ] && restorecon /dev/mapper /dev/mapper/control >/dev/null 2>&1
                        [ -n "$SELINUX_STATE" -a -e "$path" ] && restorecon -R "$path"
                                [ -n "$SELINUX_STATE" -a -e "$path" ] && restorecon -R "$path"
                                [ -n "$SELINUX_STATE" -a -e "$path" ] && restorecon -R "$path"
   restorecon /etc/mtab /etc/ld.so.cache /etc/blkid/blkid.tab /etc/resolv.conf >/dev/null 2>&1
[ -n "$SELINUX_STATE" ] && restorecon /tmp
[ -n "$SELINUX_STATE" ] && restorecon /tmp/.ICE-unix >/dev/null 2>&1

And that's just getting the system up to single-user.  Things like sendmail
and sshd require more restorecon handholding in their rc.init files.

Or just look at the creeping horror that is 'restorecond' (in particular,
consider that the default restorcond.conf contains the strings '~/public_html'
and '~/.mozilla/plugins/libflashplayer.so'.  Yee. Frikkin. Hah. ;)

Attachment: pgp00000.pgp
Description: PGP signature