Re: request for review of, and collaboration on SELinux models wiki entry

[Dominick Grift <domg472@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1818 bytes --]

On Thu, 2009-07-02 at 17:25 +0200, Sebastian Pfaff wrote:
> hello,
> 
> from http://selinuxproject.org/page/SELinux_models (Multi Category  
> Security):
> 
> [...] Multi Category Security and Multi Level Security are mutually  
> exclusive.
> 
> > - MCS and MLS are just particular configurations of constraints for  
> > the
> > MLS engine and thus share the same field and engine logic.  MCS was an
> > attempt to make the MLS field and engine useful for general users, and
> > is being leveraged by sandbox and by svirt for separating multiple
> > instances of sandboxes or guest VMs.
> 
> In other words: MCS and MLS are not mutally exclusiv?! Not in SELinux  
> and not in gernal? For me, MCS in SELinux is an "extra",  which  you  
> can use with MLS (or MLS engine) at the same time. Please correct me,  
> if i'm wrong.
> 
> Imho, MCS uses "compartments" or categories to realize the need to  
> know principle and MLS uses vertical levels to achieve (at least in  
> SELinux) confidentiality (BLP model). Imo compartments and levels are  
> not mutally exclusive.

MCS and MLS are SELinux models (MCS and MLS are just particular
configurations of constraints for the MLS engine and thus share the same
field and engine logic.)

The MCS configuration of constraints conflict with the MLS configuration
of constraints.

In MCS the usage of assigned compartments is to the discretion of the
user

In MLS the usage of assigned compartments is mandatory.

As far as i know MCS and MLS are mutually exclusive. 

> --
> Sebastian Pfaff
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 197 bytes --]