On Tue, 2003-10-14 at 16:07, Chris PeBenito wrote:
> > I would think that some sort of trusted-path execution setup would be
> > better. I don't know much about TPE, but this sounds like one situation
> > that it would be good for. Then you could set it to not do domain
> > transitions on untrusted stuff, and also require that sysadm_t only
> > execute trusted stuff. The status as trusted or untrusted could be
> > handled by another xattr. Then it also would not get overridden by a
> > relabel. But I'm getting ahead of myself, since there is no TPE in
> > SELinux. </brainstorm>
> >
> > Might there one day be TPE in SELinux, or is that beyond its scope?

Use type enforcement instead.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.