Re: Rule Set Based Access Control (RSBAC)

[Amon Ott <ao@rsbac.org>]

On Mon, 02 Apr 2001 Stephen Smalley wrote:
> 7) Most of the RSBAC policy modules are very hardwired in their
> policy logic, and can be easily expressed using the SELinux Type
> Enforcement (TE) configuration.

After rereading Section 'Overview' of your 'Security Policy Configuration'
paper, and remembering a similar claim at another place, which I had no way of
answering, I kindly ask for some explanation.

Without knowing your exact model details, I believe your claim 'can be easily
expressed using SELinux Type Enforcement' to be

- completely wrong for Privacy Model (PM), Malware Scan (MS), Role Compatibility
(RC) and Access Control Lists (ACL)

- doubtful for Mandatory Access Control (MAC), File Flags (FF) and
Authentication (AUTH)

- correct for the very simple models Functional Control (FC) and Security
Information Modification (SIM)


Since I regard all modules except FC and SIM as important models (or at least
modules), I hereby ask you to either

- prove your claim or

- officially take it back

for all these models.

Amon.

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.