Re: [gentoo-hardened] Vconfig on a selinux box

[Chris PeBenito]

On Fri, 2005-05-13 at 20:59 +0200, Aleksander Kamil Modzelewski wrote:
> I am trying to set up vlans (and several other things) on a hardened gentoo
> box. I found out, that moving the vconfig to ifconfig_exec_t makes it almost
> done, and I have seen that done with tc and ip, _but_ I'd like to just feel
> sure that this is the right way.

Here are a few questions to try to help you answer your question.

1. How conceptually similar is vconfig to ifconfig in terms of
functionality?

2. By running vconfig in ifconfig_t and adding permissions to ifconfig_t
to make vconfig work, will this give ifconfig permissions that it
doesn't need that could be exploited?  For example, giving ifconfig_t
sys_admin capability or raw disk access, or reading shadow_t, or even
something simple like writing to etc_t.

If you answered "very similar" for #1 and "no" for #2, you've probably
made the right decision.  If you say "very similar" for #1, and "yes"
for #2, you should probably copy the ifconfig.te to vconfig.te and
rename the types in vconfig.te (s/ifconfig/vconfig/g), and add your
policy there.  If you say "not very similar" for #1, then you probably
made the wrong decision.

I can't say for sure what the right course of action is until you show
us the policy you've added. :)

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243