On Sun, 2006-10-29 at 15:01 +1000, Russell Coker wrote:
> On Sunday 29 October 2006 15:30, Michael Graffam <michael.graffam@gmail.com>
> wrote:
> > Thank you for the help. Can one AND/OR the contexts? Based on the above,
> > it would seem to me that if an executable violated two points of policy
> > it wouldn't be possible to 'bless' it -- since I'm sure this isn't the
> > case, I'm wondering how I might apply multiple contexts. Or am I still
> > out in left field here?
>
> I don't know what you mean by "bless" in this message.

By "bless" I meant "Allow it to run regardless." Or "Give it the blessing to misbehave."

> If however a file could have multiple types then such analysis would be
> impossible unless you also had rules determining which pairs of contexts
> might be applied to one file (in which case every permitted pair of contexts
> could be mapped to a single context in the current SE Linux system for the
> same result).

OK, that makes perfect sense. I had figured that multiple contexts would be allowed, to prevent the possible need of expanding the number of required 'base' contexts. But, I can certainly see your point about the difficulty of analyzing all possible combinations.

> > Whooo.. new ls fields too! Man, I feel like a kid again! This is
> > great! :) Having been using GNU/Linux for so long, I almost forgot how
> > fun it is to learn new stuff about it!
>
> There is also "id -Z", "ps -Z" and "cp -Z". There are also a few new
> commands, in addition to chcon there's runcon and newrole (which isn't being
> used so much nowadays) and there is semanage and getsebool/setsebool to
> manage it.

Thanks again for your help. Would you happen to know if there is a document somewhere which gives a general overview of the structure of the SELinux mechanisms, maybe with some details on the common contexts and so forth?

-M

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.