Re: [RFC][PATCH] selinux: enable authoritative granting of capabilities

[Casey Schaufler <casey@schaufler-ca.com>]

--- James Morris <jmorris@namei.org> wrote:

> On Mon, 11 Jun 2007, Casey Schaufler wrote:
> 
> > and dealing with interactions with them. My only concern is that you
> > seem to be sneaking around the "additional restrictions" LSM model,
> > with the justification being that the bit you're taking authority over
> > is also an LSM module.
> 
> SELinux itself stacks capabilities as a secondary module, and thus already 
> has full authority over the LSM in the coarse sense of whether it is 
> actually loaded or not.

You betcha. To date it has always respected the denials generated by
the mechanism, however. If the leading advanced security scheme (SELinux)
asserts authority over another scheme (capabilities) such that the
latter is perceived to behave differently when the system has been
"secured" (even though it is in fact SELinux that is changing its
behavior) the untrained observer may reasonably assume that the "new"
behavior is more secure than the old even though it may actually be
less restrictive.

I would prefer that the pretext of "stacking" with capabilities be
abandoned if the plan is to ignore the "additional restrictions"
rule. As you say, SELinux already has full authority over
capabilities by virtue of linkage and the lack of real stacking.


Casey Schaufler
casey@schaufler-ca.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.