Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg)

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Andy Lutomirski <luto@amacapital.net>
Newsgroups	linux.kernel
Subject	Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg)
Date	Tue, 01 Sep 2015 23:50:01 +0200
Message-ID	<q41Bf-21v-5@gated-at.bofh.it> (permalink)
References	<pVLjX-jQ-5@gated-at.bofh.it> <q0WHL-48j-5@gated-at.bofh.it> <q3zlF-3rM-35@gated-at.bofh.it> <q3A81-4DV-3@gated-at.bofh.it> <q3CMy-8uA-5@gated-at.bofh.it> <q3XnY-4ya-13@gated-at.bofh.it> <q3YDo-6fB-11@gated-at.bofh.it> <q3Z6p-72W-3@gated-at.bofh.it> <q3Zzs-7B3-19@gated-at.bofh.it> <q3ZSO-7XX-21@gated-at.bofh.it> <q40ca-7Z-15@gated-at.bofh.it> <q41hU-1F0-7@gated-at.bofh.it>
X-Original-To	Josh Boyer <jwboyer@fedoraproject.org>
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=4hvrjl37JvjbSdW2DCBoEtN1TWAY5GbTdvJ3x7C3R+8=; b=f6s0y7qmbJBqksX4RIuq4ygLo/OJmOcNorxR4BcoefSG7Vop04C/wlMiR5wjVDAakq pblRynuToPfWlSrMmrGTlqK3SphDmcTlsOiRXeo11826dRiiDINLiCjUviD7tSsof4CS d2rSzLtvORPqY84pX4OJhPU+jrkGse+mN/bkWLP2WKRXsTFbhqjSUYB8XezBXjsACDJx HA8cIocJjle2xnL05KKp1IGXJusHBpGfdweiiKtAHrFJzLuL5SSiOOewqXa46UAc8vMF bGQmpH2Sw3s3Y2X5yJVmDmxcbqN2HCYbCsaLV5K3Wa38bU2IQLIeUiZHBp09JfTRh0iE 0YVg==
X-Gm-Message-State	ALoCoQlTPOYSRT4sDr4dOBRAJ2Y79P741vsa2VjMAXjnGMTwx7MzcXfJn8HipDdcqN30DLdsUDiX
X-Received	by 10.202.4.12 with SMTP id 12mr18304385oie.93.1441143655519; Tue, 01 Sep 2015 14:40:55 -0700 (PDT)
MIME-Version	1.0
Content-Type	text/plain; charset=UTF-8
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	18
Organization	linux.* mail to news gateway
X-Original-Cc	David Herrmann <dh.herrmann@gmail.com>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Greg KH <gregkh@linuxfoundation.org>
X-Original-Date	Tue, 1 Sep 2015 14:40:35 -0700
X-Original-Message-ID	<CALCETrVcE6-XJSsV2wW=dyjpC1=Gx9ogFXx3s96=uEQMARTf_w@mail.gmail.com>
X-Original-References	<CALCETrW4FaRTvCoMoZ4uUGu5zux2Mw-AhtELh-ZJ1K-LcdpyWw@mail.gmail.com> <CANq1E4Swj6v+4BogZ5aWngLwc6x21kc6QMRgdt6ZKcJutCqMPw@mail.gmail.com> <CALCETrVd2rEAuBkCML+ESHLhWT90fk8MJ-S580c84xzBuugthg@mail.gmail.com> <CANq1E4TnH9WeHFwKPnZQ6i4rY2cKWxgjhNvqsbM5WPiORXxyBA@mail.gmail.com> <CALCETrV_s1i0ttc+tgH=Un0WsPv3-otsq4uEdDLZXJWPCqbdxA@mail.gmail.com> <CA+5PVA6K6yRxCKfANQz2b_81Rn-9_3zdNxKfc-vt5Su04L7DhA@mail.gmail.com> <CALCETrV=1upVBxQHybFZ7BYmQmS5nSbeeCoX+_x_5Kf9SSjxMA@mail.gmail.com> <CA+5PVA5maoh-T3HDJQ-BzX69wnWPwyxsnvYLZv7dremSQro9sA@mail.gmail.com> <CALCETrWYc+SqQ4nLu5mRrT3Nm_n1F319L0e-CL7k1jV8QJW5=g@mail.gmail.com> <CA+5PVA5hFVREbhKJFpsFsL-HHjRyddMnxoCy_1U+fSNKY2si-Q@mail.gmail.com> <CALCETrX1otK=HAXOZedXcDN3jKYgQXTfz1LYVKhq5zqkD9gdkQ@mail.gmail.com> <CA+5PVA4FQp__QFYmtp0paEV62o+=PayNa8fSPAZqcROAFtC_wQ@mail.gmail.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1217105

Show key headers only | View raw

On Tue, Sep 1, 2015 at 2:24 PM, Josh Boyer <jwboyer@fedoraproject.org> wrote:
>
> Confining things through xattr labels on inodes.  ;)  FWIW, despite
> warnings to the contrary, the test system I have does boot just fine
> with SELinux in Enforcing mode.  It is likely the least scientific and
> useful scenario though, as it is just a dumb headless NUC box that all
> I do is test kernels on.  I won't even pretend that my mention here is
> anything more than an anecdote along the lines of "cool story, bro."

It's too bad that there isn't a well-supported way to lock down /proc
other than setting up inode labels and adding MAC policy.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) David Herrmann <dh.herrmann@gmail.com> - 2015-08-24 12:00 +0200
  Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Andy Lutomirski <luto@amacapital.net> - 2015-08-31 17:40 +0200
    Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) David Herrmann <dh.herrmann@gmail.com> - 2015-08-31 18:30 +0200
      Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Andy Lutomirski <luto@amacapital.net> - 2015-08-31 21:20 +0200
        Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-01 19:20 +0200
          Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Andy Lutomirski <luto@amacapital.net> - 2015-09-01 20:40 +0200
            Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-01 21:10 +0200
              Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Andy Lutomirski <luto@amacapital.net> - 2015-09-01 21:40 +0200
                Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-01 22:00 +0200
                Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Andy Lutomirski <luto@amacapital.net> - 2015-09-01 22:20 +0200
                Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Josh Boyer <jwboyer@fedoraproject.org> - 2015-09-01 23:30 +0200
                Re: kdbus_proc_permission (Re: [GIT PULL] kdbus updates for Greg) Andy Lutomirski <luto@amacapital.net> - 2015-09-01 23:50 +0200

csiph-web