diff mbox series

[v2] selinux-notebook: describe nosuid and NNP transitions

Message ID 20210627202859.5124-1-toiwoton@gmail.com (mailing list archive)
State Accepted
Delegated to: Paul Moore
Headers show
Series [v2] selinux-notebook: describe nosuid and NNP transitions | expand

Commit Message

Topi Miettinen June 27, 2021, 8:28 p.m. UTC 
Describe cases where nosuid_transition or nnp_transition are needed.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 src/computing_security_contexts.md | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

Comments

Paul Moore July 13, 2021, 2:22 a.m. UTC | #1 
On Sun, Jun 27, 2021 at 4:29 PM Topi Miettinen <toiwoton@gmail.com> wrote:
>
> Describe cases where nosuid_transition or nnp_transition are needed.
>
> Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
> ---
>  src/computing_security_contexts.md | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)

Merged with some minor typo fixes - thanks for your help and patience Topi!
diff mbox series

Patch

diff --git a/src/computing_security_contexts.md b/src/computing_security_contexts.md
index bb946b5..ca514d7 100644
--- a/src/computing_security_contexts.md
+++ b/src/computing_security_contexts.md
@@ -84,7 +84,18 @@  Processes inherit their security context as follows:
    *default_type* (policy version 28) or if a security-aware process,
    by calling ***setexeccon**(3)* if permitted by policy prior to
    invoking exec.
-3. At any time, a security-aware process may invoke ***setcon**(3)* to
+3. If the loaded SELinux policy has the nnp_nosuid_transition policy
+   capability enabled there are potentially two additional permissions
+   that are required to permit a domain transition: nosuid_transition
+   for nosuid mounted filesystems, and nnp_transition for for threads
+   with the no_new_privs flag. If nnp_nosuid_transition policy
+   capability is disabled, such domain transitions are denied but
+   bounded domain transitions are still allowed. In bounded
+   transitions, target domain is only allowed a subset of the
+   permissions of the source domain.  See also
+   [**Linux Security Module and SELinux**](lsm_selinux.md#linux-security-module-and-selinux)
+   section.
+4. At any time, a security-aware process may invoke ***setcon**(3)* to
    switch its security context (if permitted by policy) although this
    practice is generally discouraged - exec-based transitions are
    preferred.