From: Colin Walters <walters@verbum.org>
To: Michael Luu <mluu@cougaarsoftware.com>
Cc: selinux@tycho.nsa.gov
Subject: Re: writing a java policy file
Date: 30 Jul 2003 23:30:56 -0400 [thread overview]
Message-ID: <1059622256.12917.5.camel@columbia> (raw)
In-Reply-To: <003e01c35707$c0cf6230$ef0111ac@mluudt>
On Wed, 2003-07-30 at 22:02, Michael Luu wrote:
> hi all,
>
> i'm trying set up a simple java policy whereby i only allow a specific
> user (in java_r role) to run a java (type java_t)application that
> communicates with a server (e.g., www.yahoo.com).
I think that java_t is a bad name for what you're doing. It seems to me
that you are writing a policy for a program which is implemented in
Java, not the JVM itself.
What you probably want to do is write up a macro like
uses_java(foo_t)
that gives an application privileges to do everything that the JVM does
by default (i.e. using shared libraries, maybe mmapping /dev/zero,
whatever).
Then you should write a policy for your application, call it myapp_t,
and use the uses_java macro. The .fc file looks fine though.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
prev parent reply other threads:[~2003-07-31 3:35 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-07-31 2:02 writing a java policy file Michael Luu
2003-07-31 3:30 ` Colin Walters [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1059622256.12917.5.camel@columbia \
--to=walters@verbum.org \
--cc=mluu@cougaarsoftware.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.