Re: appending rsbac data to /proc/$pid/status

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============0893207506==
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="NlMB6dL0neEp6LNXFWoPelFk0OpJJA0Iw"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--NlMB6dL0neEp6LNXFWoPelFk0OpJJA0Iw
From: Amon Ott <[email protected]>
To: RSBAC Discussion and Announcements <[email protected]>
Message-ID: <[email protected]>
Subject: Re: [rsbac] appending rsbac data to /proc/$pid/status
References: <[email protected]>
In-Reply-To: <[email protected]>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Am 13.03.18 um 23:20 schrieb Javier Juan Mart=C3=ADnez Cabez=C3=B3n:
> Hi Amon, I think it would be useful to append rsbac data to
> /proc/$pid/status or make something like this under /proc/rsbac-info. I=
t
> would help userspace development tools highly.
>=20
> For example rc_role of this process, rc_type of proc, w or x enabled or=

> not, if jailed etc, the kind of data that we could retrieve from
> attr_get_process.

Reading various process attributes goes through individual access
control checks in all decision modules. Putting them into one /proc file
would either make detailed control impossible or change the format
depending on current access rights.

What we could e.g. do is add new files into /proc/$pid/rsbac/, each
named like the attribute and containing a single value.

However, I would prefer a ps extension in C that uses librsbac to get
the values through sys_rsbac system calls. This would be much faster and
actually easier than parsing files, and it would come with two
advantages: full access control and no further extensions to /proc.
There are also python bindings flying around somewhere.

The idea of a ps extension is not new, but nice, I might soon have a
look at it myself.

Amon.
--=20
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22


--NlMB6dL0neEp6LNXFWoPelFk0OpJJA0Iw
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iEUEARECAAYFAlqs6bgACgkQq9yn6h5RTo8jSgCXX/+Sw7JWy2aAaVHETgK151VT
9gCcDossEfRibeZ99Xz7AfjxGKUilS4=
=SPuK
-----END PGP SIGNATURE-----

--NlMB6dL0neEp6LNXFWoPelFk0OpJJA0Iw--

--===============0893207506==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
rsbac mailing list
[email protected]
http://www.rsbac.org/mailman/listinfo/rsbac
--===============0893207506==--