Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On 07/13/2017 04:11 PM, Dominick Grift wrote: On Thu, Jul 13, 2017 at 03:59:29PM -0400, Stephen Smalley wrote: On Thu, 2017-07-13 at 21:43 +0200, Dominick Grift wrote: On Thu, Jul 13, 2017 at 09:28:43PM +0200, Dominick Grift wrote: On Thu, Jul 13, 2017 at 03:29:56PM -0400, Stephen Smalley

Re: [PATCH] Additional tests for long-time supported netlink classes

On Thu, Jul 13, 2017 at 1:35 PM, Stephen Smalley wrote: > Also, I wanted to mention that this still doesn't address testing of > the finer-grained permissions for netlink sockets, e.g. > nlmsg_read/write/..., as noted in the open issue: >

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, Jul 13, 2017 at 11:48 AM, Stephen Smalley wrote: > On Thu, 2017-07-13 at 09:25 -0400, Paul Moore wrote: >> Sorry to be a stubborn about this, but nnp_transition makes little >> sense for the nosuid restriction. Like it or not, NNP has a concrete >> meaning which is

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, Jul 13, 2017 at 03:59:29PM -0400, Stephen Smalley wrote: > On Thu, 2017-07-13 at 21:43 +0200, Dominick Grift wrote: > > On Thu, Jul 13, 2017 at 09:28:43PM +0200, Dominick Grift wrote: > > > On Thu, Jul 13, 2017 at 03:29:56PM -0400, Stephen Smalley wrote: > > > > On Thu, 2017-07-13 at 20:16

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, Jul 13, 2017 at 03:29:56PM -0400, Stephen Smalley wrote: > On Thu, 2017-07-13 at 20:16 +0200, Dominick Grift wrote: > > On Thu, Jul 13, 2017 at 02:13:40PM -0400, Stephen Smalley wrote: > > > On Thu, 2017-07-13 at 18:55 +0200, Dominick Grift wrote: > > > > On Thu, Jul 13, 2017 at 11:59:55AM

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, Jul 13, 2017 at 08:16:14PM +0200, Dominick Grift wrote: > On Thu, Jul 13, 2017 at 02:13:40PM -0400, Stephen Smalley wrote: > > On Thu, 2017-07-13 at 18:55 +0200, Dominick Grift wrote: > > > On Thu, Jul 13, 2017 at 11:59:55AM -0400, Stephen Smalley wrote: > > > > On Thu, 2017-07-13 at 11:48

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, 2017-07-13 at 21:43 +0200, Dominick Grift wrote: > On Thu, Jul 13, 2017 at 09:28:43PM +0200, Dominick Grift wrote: > > On Thu, Jul 13, 2017 at 03:29:56PM -0400, Stephen Smalley wrote: > > > On Thu, 2017-07-13 at 20:16 +0200, Dominick Grift wrote: > > > > On Thu, Jul 13, 2017 at 02:13:40PM

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, Jul 13, 2017 at 09:28:43PM +0200, Dominick Grift wrote: > On Thu, Jul 13, 2017 at 03:29:56PM -0400, Stephen Smalley wrote: > > On Thu, 2017-07-13 at 20:16 +0200, Dominick Grift wrote: > > > On Thu, Jul 13, 2017 at 02:13:40PM -0400, Stephen Smalley wrote: > > > > On Thu, 2017-07-13 at 18:55

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, 2017-07-13 at 20:16 +0200, Dominick Grift wrote: > On Thu, Jul 13, 2017 at 02:13:40PM -0400, Stephen Smalley wrote: > > On Thu, 2017-07-13 at 18:55 +0200, Dominick Grift wrote: > > > On Thu, Jul 13, 2017 at 11:59:55AM -0400, Stephen Smalley wrote: > > > > On Thu, 2017-07-13 at 11:48 -0400,

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, Jul 13, 2017 at 02:13:40PM -0400, Stephen Smalley wrote: > On Thu, 2017-07-13 at 18:55 +0200, Dominick Grift wrote: > > On Thu, Jul 13, 2017 at 11:59:55AM -0400, Stephen Smalley wrote: > > > On Thu, 2017-07-13 at 11:48 -0400, Stephen Smalley wrote: > > > > On Thu, 2017-07-13 at 09:25

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, 2017-07-13 at 18:55 +0200, Dominick Grift wrote: > On Thu, Jul 13, 2017 at 11:59:55AM -0400, Stephen Smalley wrote: > > On Thu, 2017-07-13 at 11:48 -0400, Stephen Smalley wrote: > > > On Thu, 2017-07-13 at 09:25 -0400, Paul Moore wrote: > > > > On Thu, Jul 13, 2017 at 8:44 AM, Stephen

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, Jul 13, 2017 at 11:59:55AM -0400, Stephen Smalley wrote: > On Thu, 2017-07-13 at 11:48 -0400, Stephen Smalley wrote: > > On Thu, 2017-07-13 at 09:25 -0400, Paul Moore wrote: > > > On Thu, Jul 13, 2017 at 8:44 AM, Stephen Smalley > > > > > > wrote: > > > > On Wed,

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, 2017-07-13 at 11:48 -0400, Stephen Smalley wrote: > On Thu, 2017-07-13 at 09:25 -0400, Paul Moore wrote: > > On Thu, Jul 13, 2017 at 8:44 AM, Stephen Smalley > > > > wrote: > > > On Wed, 2017-07-12 at 20:27 -0400, Chris PeBenito wrote: > > > > On 07/12/2017 05:38 PM,

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, 2017-07-13 at 09:25 -0400, Paul Moore wrote: > On Thu, Jul 13, 2017 at 8:44 AM, Stephen Smalley > wrote: > > On Wed, 2017-07-12 at 20:27 -0400, Chris PeBenito wrote: > > > On 07/12/2017 05:38 PM, Paul Moore wrote: > > > > On Wed, Jul 12, 2017 at 9:26 AM, Stephen

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Thu, Jul 13, 2017 at 8:44 AM, Stephen Smalley wrote: > On Wed, 2017-07-12 at 20:27 -0400, Chris PeBenito wrote: >> On 07/12/2017 05:38 PM, Paul Moore wrote: >> > On Wed, Jul 12, 2017 at 9:26 AM, Stephen Smalley > > > wrote: >> > > On Tue, 2017-07-11 at

Re: [RFC][PATCH] selinux: Introduce a policy capability and permission for NNP transitions

On Wed, 2017-07-12 at 20:27 -0400, Chris PeBenito wrote: > On 07/12/2017 05:38 PM, Paul Moore wrote: > > On Wed, Jul 12, 2017 at 9:26 AM, Stephen Smalley > > wrote: > > > On Tue, 2017-07-11 at 17:00 -0400, Paul Moore wrote: > > > > On Mon, Jul 10, 2017 at 4:25 PM, Stephen

[PATCH] Additional tests for long-time supported netlink classes

This patch contains tests for classes which are already supported for a long time but are not tested by the selinux-testsuite yet. These tests involve classes like: netlink_route_socket, netlink_xfrm_socket, netlink_selinux_socket, netlink_audit_socket, netlink_kobject_uevent_socket,