3 ms·

Or maybe a hook could be added to the kernel in the looks of "if mozilla_t is denied access to user_home_t, execute /usr/bin/notify and if it returns 0 allow it

• gizmo686 6y ago
  You can kind of do that already using SELinux booleans. In policy, have something like: if (mozilla_read_user_home) { allow mozilla_t user_home_t:file read_file_perms; } Then, firefox could execute /usr/bin/request_file_access user_home_t read request_file_access could then be spawned in a privileged domain and: 1) Check the domain of the parent process and see that it is mozilla_t 2) Check whatever security policy it wants to implement (possibly by prompting the user) 3) Assuming the access is allowed, set the mozilla_read_user_home variable to true (and set a timer to disable it at some point in the future) 4) firefox then can open the file normally. Keep in mind that denials actually happen quite frequently on many SELinux systems, and policy is usualy written to not even log the expected ones. Any hook that needs to run on every denial would likely introduce unacceptable performance hits; particuarly if it needs to spawn another process.