-----Original Message-----
From: Russell Coker [mailto:russell@coker.com.au] Sent: Wednesday, September 24, 2003 9:22 AM To: Inger, Slav (S.B.); 'selinux@tycho.nsa.gov' Subject: Re: Sample SELinux policy that's equivalent to standard root?

> The domain sysadm_t has 99% of the ability that "root" has on a non-SE
> machine, of course you need to have both UID=0 and context
> something:sysadm_r:sysadm_t to get full access.
>
> Adding the ability to directly read /etc/shadow, block devices, and the few
> things that are denied to sysadm_t is easy enough. However in many cases
> programs that you run will automatically transition to other domains which
> have less access. For example fdisk has no access files on a file system.
> So if you want to do "fdisk < /root/commands > /tmp/output" then it will not
> work.
>
> Why would you want things to be other than they are in the default policy?

Because, like I said in the earlier message, I'd like to start with full root permissions and tighten up, instead of doing it the other way around. Basically, I'd like to put together a quick POC where I'd like to demonstrate that while SE root can do everything a regular root can, several files and processes will be off limits to root. Enabling 99% of typical root functionality manually is turning out to be a time consuming process.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.