Re: uml policy

[Tom <tom@lemuria.org>]

On Fri, Sep 13, 2002 at 12:53:55AM +0200, Russell Coker wrote:
> NB You need separate types for the kernel and the disk image.  The kernel 
> should not be writable...

Yes, and the backing store file should also not be writeable, just the
cow file and the keystroke logger files.


> You possibly don't want the system to run it (but that is debatable), however 
> you certainly want to be able to install a kernel as the administrator and 
> have regular users execute it.

Shouldn't chcon be able to do that?

Ah, I'll find out.


> Chroot is probably too heavy, irc is simpler and easier to copy from.  For 
> keystroke logger files I guess you could make them append-only.  Or you could 
> use the same read-write file you use for the data store.

Definitely append only, but the problem is that they are created on
runtime, not like logfiles where you can assume that it exists when you
execute.
And they are always created in the uml dir. I'll look into the uml
source what exactly is hardcoded there. I would definitely prefer them
to be in their own subdir.

-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.