Re: dynamic context transitions

On Tue, Nov 02, 2004 at 08:47:48AM -0500, Stephen Smalley wrote:
> On Mon, 2004-11-01 at 17:58, Luke Kenneth Casson Leighton wrote:
> > e.g. if you _do_ implement exec_mls_up/downgrade() then you
> > can actually express that simply as a domain_auto_trans()
> > and an exec()?
> >
> > which _actually_ means that you really should abandon MLS altogether
> > and rewrite your applications to use selinux TE instead?
> >
> > ... i'm just following a logical progression here, but i feel i must
> > have missed something. clues anyone?
>
> TE is an access matrix, so it can represent a MLS policy, but the
> resulting representation would be huge for any significant number of MLS
> levels.

 so, this is again a bit like the "groups" argument - the one  where the number of bits representing the access matrix could  go exponential [and impractical]?

 l.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.