Bug 213475

Summary: Add an additional MLS constraint to allow writing over the range of a file
Product: Red Hat Enterprise Linux 5 Reporter: Matt Anderson <mra>
Component: selinux-policyAssignee: Daniel Walsh <dwalsh>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 5.0CC: iboverma, linda.knippers, sgrubb
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 5.0.0 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-11-28 21:08:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
The original patch posted to the SELinux mailing list none

Description Matt Anderson 2006-11-01 16:56:49 UTC 
Description of problem:
Ranged printers are currently not supported by the selinux-policy

Version-Release number of selected component (if applicable):


How reproducible:
everytime

Steps to Reproduce:
1. use chcon -l SystemLow-Secret /dev/lp0
2. newrole -l Unclassified
3. attempt to print lpr /etc/passwd
  
Actual results:
SELinux will deny access to the printer

Expected results:
Since the printer device is ranged write access should be allowed over the range

Additional info:
The following patch has been accepted upstream in the reference policy, with the
change of the line:
mls_file_write_within_range(printer_device_t)
was moved to the policy/modules/kernel/devices.te file instead of
policy/modules/services/cups.te
Comment 1 Matt Anderson 2006-11-01 16:56:49 UTC 
Created attachment 140004 [details]
The original patch posted to the SELinux mailing list
Comment 2 Daniel Walsh 2006-11-06 18:43:06 UTC 
Fixed in selinux-policy-2.4.3-1
Comment 4 RHEL Program Management 2006-11-06 23:06:44 UTC 
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux release.  Product Management has requested further review
of this request by Red Hat Engineering.  This request is not yet committed for
inclusion in release.
Comment 5 Jay Turner 2006-11-07 18:35:00 UTC 
QE ack for RHEL5B2.