Skip to content

Clarify extended permission evaluation #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Clarify extended permission evaluation #48

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions src/xperm_rules.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# Extended Access Vector Rules

- [Extended Permission Evaluation](#extended-permission-evaluation)
- [*ioctl* Operation Rules](#ioctl-operation-rules)
- [*nlmsg* Operation Rules](#nlmsg-operation-rules)

Expand Down Expand Up @@ -74,6 +75,29 @@ Conditional Policy Statements
| ----------------------- | ----------------------- | ----------------------- |
| No | No | No |

### Extended Permission Evaluation

Extended permission rules are evaluated as follows:

* If no extended permissions are defined, the standard SELinux checks around AVC
rules and constraints will be performed.

* If an extended permission rule is defined, the policy is evaluated so that
both the standard AVC checks and the extended permissions must pass. For example:

* If an *allowxperm* rule is defined, extended permissions will only be
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This sort of makes it sound like "allow" is sufficient (and xperm is totally worthless). Maybe something about "both checks must pass" or similar would be clearer?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good point. I've updated this to state that "both the standard AVC checks and the extended permissions must pass". Please let me know if this statement needs any more clarification.

granted if *allow* is granted to the resource.

* If an *auditallowxperm* rule is defined, extended auditing will only
be performed if *auditallow* is allowed for the resource.

* If any extended permission rule is defined, the resource and operation are fully
evaluated according to extended access rules. All unspecified permissions within
the available *xperm_set* will be automatically denied.

All extended permissions are deny-by-default. If extended permission rules are used,
any allow permissions must be granted explicitely.

### *ioctl* Operation Rules

Use cases and implementation details for ioctl command allowlists are described
Expand Down