Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing ListRe: Multiple contexts
From: Luke Kenneth Casson Leighton <lkcl_at_lkcl.net>
Date: Mon, 10 Jan 2005 23:23:12 +0000
i understand the mindset of selinux enough now to be able to say that the recommended approach would be for you to create a file type samba_share_httpd_sys_content_t and then for you to modify the selinux policy to grant the programs requiring access to those filetypes in the samba.te and the apache.te policy files.
> I have to edit the cryptic m4 policy file to add a type that's
> (1) Label the file with both contexts, and permit yes, it does seem a little curious: taking NT security descriptors (actually VMS SDs) as an example, and ignoring the fact that NT/VMS SDs contain DAC (discretionary) ACLs - each ACL is just that - an access control LIST. whereas in NT, the SD contains ACLs and the ACLs can be extended, modified and edited (and are better understood!), SElinux turns things roundabout somewhat: providing a reference (handle) into a binary policy. what i _am_ aware of is that by having the policies in a structured language, formal analysis tools can be applied to make certain guarantees and proofs. in paranoid security environments, it's far more important to be able to prove that someone _could_ break in than to not _know_ if they could break in (!) i can only hazard a hazardous guess therefore that the more "normal" ACL system [that we are used to seeing] was rejected because it makes the formal proof methodology more difficult. *shrug*. *clueless*. anyone know? l. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Mon 10 Jan 2005 - 18:58:51 EST |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |