On Wed, 2003-09-03 at 03:12, Tom wrote:
> The broad public will not be using SELinux for now, so I'm afraid it's
> not really a special case.
>
> There should, however, be a kernel config option to turn it on by
> default and FORCE it on. (i.e. no way to boot that kernel without SE
> enabled). Otherwise we have a trivial boot security problem.
>
> I know securing physical access to the system isn't really the scope of
> SE, but it shouldn't be THAT easy.

It is already the case that you need to specify 'enforcing=1' to boot an enforcing kernel if you enabled development support. How many people disable development support? And if you do disable development support, do you also keep around a second kernel that you can boot for emergency recovery? In that case, what is the difference? You are still are relying on your lilo/grub password to limit the ability to boot the non-SELinux kernel.  

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.