change rol with MAP_EXEC
Javier Juan Martínez Cabezón <[email protected]>
| Newsgroups | gmane.linux.rsbac |
|---|---|
| Message-ID | <[email protected]> |
Hi, Could be extended the marked rol transition forced_rol, initial_rol from EXECUTE to EXECUTE and MAP_EXEC calls? The explanation to this is the following: I'm trying make a wrapper python role to make a transition from python_r (assigned as initial role to /usr/bin/python2.7) to user inherited role, This is what seems to happen in logs If rc_role_wrap is used in script then is first called changed to defined role Even without rc_role_wrap and executed as ./mypythonscript just one EXECUTE call is done only to /usr/bin/python2.7 not EXECUTE call to the script after both python2.7 is executed changing their role to python wrapper role python_r and run as this forever. By this reason it could never be solved modifying rc_initial_role/forced role to the script It's work reversed. The question is that python2.7 should run with initial python_r to check if the type of the script is trusted of not, if it's trusted then it should change to user inherited rol (by rc_role_wrap or by initial_role/forced role of the script), now it's never happen. I think it could be useful to could change role when MAP_EXEC call is done in this case to libpython2.7.so to make this portion of code running with user role privilege. Maybe it could be useful too to confine bug problematic ssl related libs for example. What do you think?