Re: New to SELinux -- any suggestions?

[Michael Graffam <michael.graffam@gmail.com>]

On Sun, 2006-10-29 at 15:01 +1000, Russell Coker wrote:
> On Sunday 29 October 2006 15:30, Michael Graffam <michael.graffam@gmail.com> 
> wrote:
> > Thank you for the help. Can one AND/OR the contexts? Based on the above,
> > it would seem to me that if an executable violated two points of policy
> > it wouldn't be possible to 'bless' it -- since I'm sure this isn't the
> > case, I'm wondering how I might apply multiple contexts. Or am I still
> > out in left field here?
> 
> I don't know what you mean by "bless" in this message.

By "bless" I meant "Allow it to run regardless." Or "Give it the
blessing to misbehave."


> If however a file could have multiple types then such analysis would be 
> impossible unless you also had rules determining which pairs of contexts 
> might be applied to one file (in which case every permitted pair of contexts 
> could be mapped to a single context in the current SE Linux system for the 
> same result).

OK, that makes perfect sense. I had figured that multiple contexts would
be allowed, to prevent the possible need of expanding the number of
required 'base' contexts. But, I can certainly see your point about the
difficulty of analyzing all possible combinations. 

> > Whooo.. new ls fields too! Man, I feel like a kid again! This is
> > great! :) Having been using GNU/Linux for so long, I almost forgot how
> > fun it is to learn new stuff about it!
> 
> There is also "id -Z", "ps -Z" and "cp -Z".  There are also a few new 
> commands, in addition to chcon there's runcon and newrole (which isn't being 
> used so much nowadays) and there is semanage and getsebool/setsebool to 
> manage it.

Thanks again for your help. Would you happen to know if there is a
document somewhere which gives a general overview of the structure of
the SELinux mechanisms, maybe with some details on the common contexts
and so forth?

-M


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.