RE: dynamic context transitions

> TE is an access matrix, so it can represent a MLS policy, but the
> resulting representation would be huge for any significant number of
> MLS levels. A native implementation of MLS is more efficient and
> easier to analyze. There is benefit in a hybrid TE/MLS model.

Actually, we have been struggling with this a bit, and the only MLS-like issues we seem not to be able to handle efficiently in TE is compartments. So it seems a combination of TE and categories/compartments is most efficient (though this still doesn't seem to necessitate making the mechanisms non-orthogonal).

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.