Re: [PATCH] SELinux: Always allow FIOCLEX and FIONCLEX

[Paul Moore]

On Tue, Feb 8, 2022 at 9:05 AM William Roberts <bill.c.roberts@xxxxxxxxx> wrote:
> On Mon, Feb 7, 2022 at 6:02 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
> > On Mon, Feb 7, 2022 at 4:51 PM William Roberts <bill.c.roberts@xxxxxxxxx> wrote:
> > > On Mon, Feb 7, 2022 at 3:42 PM William Roberts <bill.c.roberts@xxxxxxxxx> wrote:
> > > >
> > > > + NNK and Dan
> > > - nnk and Dan.
> > > + Jeff
> > > Let me try again, looks like Nick left, not sure about Dan.
> > > Jeff, can you look this over?
> >
> > FWIW, I'm still not convinced merging this kernel patch is something
> > we want to do, so please don't assume that it's a done deal on the
> > kernel side.
>
> I agree and I don't think we can hit the merge button until it gets buy-in from
> in-use policy holders.

One thing I should have mentioned yesterday, my current thinking is
that if we do make the kernel change it needs to be wrapped with a
policy capability just as we do with other kernel changes which have a
potential impact on policy.

-- 
paul-moore.com