On Sun, Feb 20, 2011 at 5:54 PM, Scott Gifford <span dir="ltr">&lt;<a href="mailto:sgifford@suspectclass.com">sgifford@suspectclass.com</a>&gt;</span> wrote:<div><div class="gmail_quote"><div>[ ... ] </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class="gmail_quote"><div></div><div>I think I can automatically generate a unique category set from a PID by using two MCS categories to represent each bit of the PID, the first for a 0-bit and the second for a 1-bit.  That will take 32 categories for a 16-bit PID, which seems reasonable.</div>

</div></blockquote><div><br></div><div>OK, I&#39;ve got this working now, each PID gets a unique set of MCS categories, and so HTTPD child processes canot read each other&#39;s process information.</div><div><br></div><div>

They do have to share files sometimes, so I designated c0 for that, and made sure the processes are always in c0.  Now if something should be shared, it should remove all groups besides c0, and it will be shareable.</div>

<div><br></div><div>I expected to do this through file mapping in my module&#39;s .fc file, like this:</div><div><br></div></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;">

<div><div class="gmail_quote"><div><div><font class="Apple-style-span" face="&#39;courier new&#39;, monospace">/var/www/portal_auth(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t,s0,c0)</font></div></div></div>

</div></blockquote><div><div class="gmail_quote"><div><br></div><div>But when new files are created in /var/www/portal_auth, they still have all of the PID-specific categories, in addition to c0.</div><div><br></div><div>

To make this work, I had to grant { setattr relabelfrom relabelto } to my Web app and make a call to setxattr to change the category on shared files.</div><div><br></div><div>That works, but it seems like it would be simpler and more secure to do this through file mappings in my modules .fc file.</div>

<div><br></div><div>Is there a mistake in my file context configuration above somewhere?  Or am I misunderstanding how categories are applied from file context rules?</div><div><br></div><div>Thanks for any tips,</div><div>

<br></div><div>------Scott.</div><div><br></div></div></div>