public inbox for [email protected]  

help / color / mirror / Atom feed

From: Joe Conway <[email protected]>
To: Ted Toth <[email protected]>
To: [email protected]
Subject: Re: [PATCH] Add <<none>> support to sepgsql_restorecon
Date: Sun, 15 Jan 2023 14:11:51 -0500
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <CAFPpqQH1NHRhbtOBqcXofGHhS6k5-P7H_ZY3na3zYXfW+_b2NA@mail.gmail.com>
	<[email protected]>

On 11/21/22 17:35, Joe Conway wrote:
> On 11/21/22 15:57, Ted Toth wrote:
>> In SELinux file context files you can specify <<none>> for a file
>> meaning you don't want restorecon to relabel it. <<none>> is
>> especially useful in an SELinux MLS environment when objects are
>> created at a specific security level and you don't want restorecon to
>> relabel them to the wrong security level.
> 
> +1
> 
> Please add to the next commitfest here:
> https://commitfest.postgresql.org/41/


Comments:

1. It seems like the check for a "<<none>>" context should go into 
sepgsql_object_relabel() directly rather than exec_object_restorecon(). 
The former gets registered as a hook in _PG_init(), so the with the 
current location we would fail to skip the relabel when that gets called.

2. Please provide one or more test case (likely in label.sql)

3. An example, or at least a note, mentioning "<<none>>" context and the 
implications would be appropriate.

-- 
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com

view thread (2+ messages)

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: [PATCH] Add <<none>> support to sepgsql_restorecon
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox