Re: split admins

[Tom <tom@lemuria.org>]

On Wed, Apr 24, 2002 at 09:59:37AM -0400, Stephen Smalley wrote:
> When the example policy was originally being developed, there was an
> initial attempt to provide such a distinction between a system
> administrator and a security administrator, but the separate role was
> discarded because it turns out to be very difficult to truly enforce a
> separation between these two roles without severely limiting the system
> administrator role, making it relatively useless.  The topic has also come
> up previously on the list, e.g. see
> http://marc.theaimsgroup.com/?l=selinux&m=100799744813965&w=2.

I'll check that discussion and give it a go. I'm happy with not doing
away root=god. I'm more interested in having, say, an application-level
admin (control over the daemons, network services, whatever). Just
thought a security admin would be a useful thing to start this with.


-- 
http://web.lemuria.org/pubkey.html
pub  1024D/D88D35A6 2001-11-14 Tom Vogt <tom@lemuria.org>
     Key fingerprint = 276B B7BB E4D8 FCCE DB8F  F965 310B 811A D88D 35A6

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.