audit in /selinux directory

[Stephen Smalley]

On Fri, 2007-03-09 at 16:17 -0500, Stephen Smalley wrote:
> On Fri, 2007-03-09 at 16:13 -0500, Stephen Smalley wrote:
> > On Fri, 2007-03-09 at 15:23 -0500, Steve Grubb wrote:
> > > On Friday 09 March 2007 14:31, Camilo Y. Campo wrote:
> > > > The cat command failed and audit is saying "success". A bit strange for
> > > > me. Could anybody clarify this point for me, please?
> > > 
> > > It works correctly for me:
> > > 
> > > fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
> > > open("/selinux/disable", O_RDONLY|O_LARGEFILE) = -1 EACCES (Permission denied)
> > 
> > You got EACCES rather than EINVAL, so your test didn't reach the same
> > point in the code path.  Try it as root (and with appropriate SELinux
> > role/domain if under -strict or -mls).
> 
> I tried it, and the open succeeds, but the read fails with -EINVAL
> because the underlying pseudo file doesn't implement a read method at
> all for that node.  So the audit is only capturing the open, which was
> successful.

And since one has to be root to open it at all, and root has
dac_read_search, you can bypass the DAC mode on it at open time.
So...not a bug?

-- 
Stephen Smalley
National Security Agency