Re: [gentoo-hardened] SELinux module proposal for pamldap

[Chris PeBenito]

On Mon, 2007-11-19 at 01:13 +0100, julien.thomas@×××××××××××××.fr wrote:
> The main aspect of this SELinux module consists in defining a new
> domain for the
> confinement of the PAMLDAP module. I have created this module as when
> I used the
> PamLDAP extension for remote authentications, I discovered that it used
> sensitive information for LDAP connexions.
>
> The module aims to protect these datas (security enhancement in order
> to prevent to prevent root services from accessing these previously
> etc_t labelled files).

Thanks for your submission.  I especially appreciate the design document
you wrote.  However, I don't think this particular action is required,
but another.

First, the specified domains already have access to etc_t, so these
rules are redundant.  You suggest adding a type for the ldap.conf
because it has authentication data, which I agree with.  However, the
ldap policy already has a type which might be appropriate for this file,
slapd_etc_t.

As for the style, the reference policy style is preferred.  Please see
the website [1] for more details.

[1] http://oss.tresys.com/projects/refpolicy/wiki/GettingStarted

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243