Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing ListRe: I can ' t use named on LSM-based Prototype. Why?
From: Chris Vance <cvance_at_tislabs.com>
Date: Thu, 27 Sep 2001 09:35:49 -0400 (EDT)
With RedhHat 7.1, the default configuration for named uses the '-u' flag to tell named to run as the specified user. For Linux, named uses the kernel's capability mechanism to drop all root privileges except the ability to bind() to a privileged port. As a result, the '-u' option requires Linux kernel capability checks. While the prior SELinux prototype retained these checks, the current LSM-based kernel removes the capabilities checks from the kernel and places them in a separately configurable LSM module. We are currently investigating ways to compose the SELinux module with the capabilities module or reproduce the capabilities checks in SELinux, so that we can retain all of the original Linux kernel checks. However, the current LSM-based SELinux distribution does not perform kernel capability checks. In the mean time, if you start named without that option, it should run normally. Since the default SELinux policy does not contain support for named, I would recommend adding a domain and appropriate permissions. Has anyone on this list already created a policy for named? chris. On Tue, 25 Sep 2001, Yuichi Nakamura wrote:
> I found that named(bind 9.1.0) didn't work on SELinux(LSM-based Prototype) -- You have received this message because you are subscribed to the selinux list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Thu 27 Sep 2001 - 09:49:44 EDT |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |