Re: policy question

[Tom <tom@lemuria.org>]

On Thu, Apr 18, 2002 at 04:51:01PM +0200, Russell Coker wrote:
> > Absolutely. The problem is that you have a unified frontend with
> > diversification at the backend. This is the same issue you have for
> > ssh, except that ssh (and other remote login tools) have a method for
> > changing to a specific user, based on user/password data.
> 
> Ssh solves it by forking a new process and changing UID BEFORE doing any work.

Right. I want to do the same thing, but not with UIDs, but with
domains.


> > where user2's script contains something like:
> > <? $f=fopen("../user1/script.php"); read($f); ?>
> 
> What you could do is to have a unix domain socket named /var/www/socket/user1 
> which the Apache process creates and then forks off a child process to run 
> all PHP code for user1 under the UID of that user, and then pass back the 
> data to Apache through the socket for retransmission to the client.

That requires changes in the apache code, which is bug-prone and will
probably be lost with the next upgrade. I want to put the policy
enforcement into the kernel/security server, where it belongs.


In essence, it boils down to: "a script (php, cgi, whatever) that
belongs to user X can only access files of user X"

The sole problem being that the scripts aren't executed in the
unix-sense of execution, but by being loaded and interpreted by the
apache process.



-- 
http://web.lemuria.org/pubkey.html
pub  1024D/D88D35A6 2001-11-14 Tom Vogt <tom@lemuria.org>
     Key fingerprint = 276B B7BB E4D8 FCCE DB8F  F965 310B 811A D88D 35A6

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.