In general, it’s unwise to
create overly large domains, especially domains that include
unrelated programs. The
considered in the preceding sections is perhaps such an overweight
domain, since it relates to both the traceroute
and Nmap programs. These programs perform a few somewhat similar
operations, but they’re not closely related. Because
they’re part of a single domain, a vulnerability in
either program could enable an intruder to gain control of the entire
domain. Let’s presume that we prefer to avoid that
fate and see what’s required to create a domain
specific to the Nmap program.
To do so, we’ll follow a procedure that also works in most similar cases:
Determine what files are related to the domain.
Determine the security contexts of these files.
Decide what security contexts are appropriate for the new domain.
Create a basic TE file.
Create a basic FC file that specifies proper labels for files related to the domain.
If necessary, delete conflicting specifications from other FC files.
Load the revised policy and label the domains.
Repeat the following steps as needed:
Test the program.
Tweak the TE or FC files as needed.
As the procedure directs, let’s start by finding out what files are related to Nmap:
rpm -ql nmap/usr/bin/nmap /usr/share/doc/nmap-3.50 /usr/share/doc/nmap-3.50/COPYING /usr/share/doc/nmap-3.50/README /usr/share/doc/nmap-3.50/copying.html /usr/share/doc/nmap-3.50/nmap-fingerprinting-article.txt ...