<br><br><div><span class="gmail_quote">On 4/19/07, <b class="gmail_sendername">Daniel J Walsh</b> <<a href="mailto:dwalsh@redhat.com">dwalsh@redhat.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Al Pacifico wrote:<br>> I (a greenhorn with selinux) am writing a policy for a daemon that<br>> streams music files over my home network to a music player client (a<br>> Slimdevices Squeezebox). My OS is FC5.<br>
><br>> The main daemon (/usr/sbin/slimserver) is a perl script that serves<br>> the music files and is started with an init script. My questions have<br>> to do with a secondary program (/usr/sbin/slimserver-scanner, also a
<br>> perl script) that scans the music on the server, reading mp3 tags and<br>> such, and generates a database of stored music that is stored in a<br>> MySQL database. /usr/sbin/slimserver-scanner is invoked by the
<br>> /usr/sbin/slimserver daemon and might be invoked by the user (although<br>> I can't recall ever doing so in several years of owning a Squeezebox).<br>><br>> I've been following the example posted by Dan Walsh in a blog at
<br>> <a href="http://danwalsh.livejournal.com/8707.html?thread=39171">http://danwalsh.livejournal.com/8707.html?thread=39171</a> which has been<br>> extremely helpful.<br>><br>> My (2) questions:<br>> 1. What is the appropriate file context for the scanner program?
<br>> system_u:object_r:sbin_t?<br>> system_u:object_r:slimserver_t?<br>> system_u:object_r:slimserver_exec_t?<br>><br>That depends on your security goals. If you want the slimserver-scanner<br>to have the same privs as slimserver you would label it sbin_t and allow
<br>slimserver to corecmd_exec_sbin(). If you want to go with least privs,<br>you would create a new policy for slimserver-scanner<br>(slimserver_scanner_t with file context of slimserver_scanner_exec_t)<br>and then add a rule to slimserver_t to domtrans
<br>slimserver_scanner_domtrans(slimserver_t)</blockquote><div><br>I'm a little confused about this. I want to limit privileges of slimserver and slimserver-scanner to accessing only certain files. If I label slimserver-scanner as 'sbin_t', when a user executes slimserver-scanner, won't he/she have more privileges than slimserver then?
<br></div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">> The generated slimserver.fc file contains:<br>> # slimserver executable will have:
<br>> # label: system_u:object_r:slimserver_exec_t<br>> # MLS sensitivity: s0<br>> # MCS categories: <none><br>><br>> /usr/sbin/slimserver --<br>> gen_context(system_u:object_r:slimserver_exec_t,s0)
<br>> /var/run/slimserver.pid<br>> gen_context(system_u:object_r:slimserver_var_run_t,s0)<br>> /var/log/slimserver<br>> gen_context(system_u:object_r:slimserver_var_log_t,s0)<br>><br>> and the slimserver.if
file contains:<br>> interface(`slimserver_domtrans',`<br>> gen_require(`<br>> type slimserver_t, slimserver_exec_t;<br>> ')<br>><br>> domain_auto_trans($1,slimserver_exec_t,slimserver_t)
<br>><br>> allow $1 slimserver_t:fd use;<br>> allow slimserver_t $1:fd use;<br>> allow slimserver_t $1:fifo_file rw_file_perms;<br>> allow slimserver_t $1:process sigchld;<br>
> ')<br>><br>> 2. There is no reason to add the scanner program be added to<br>> slimserver.fc that was generated by policygentool, is there?<br>Only if you are creating a context for slimserver_scanner_exec_t,
<br>otherwise just let it be labeled sbin_t.<br>> The file itself just needs to be labeled appropriately, right? Or does<br>> that file play some role in policy compilation in a step that I did<br>> not explicitly executed when I invoked 'make -f
<br>> /usr/share/selinux/devel/Makefile'?<br>><br>> Thanks in advance.<br>> -al<br>> --<br>> Al Pacifico<br>> Seattle, WA<br>> ------------------------------------------------------------------------
<br>><br>> --<br>> fedora-selinux-list mailing list<br>> <a href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a><br>> <a href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">
https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a><br><br></blockquote></div><br><br clear="all"><br>-- <br>Al Pacifico<br>Seattle, WA