Re: Cambridge Security Group talk

[Tom <tom@lemuria.org>]

On Sat, Jan 18, 2003 at 01:49:27AM +0100, Russell Coker wrote:
> One issue that drew a number of comments from the audence was the length of 
> security contexts and the amount of typing that it can involve.  One audience 
> member said "space in an Xterm is precious", another audience member 
> mentioned having three servers without X that were not administered remotely 
> (IE everything is done at the console without even an X based cut/paste 
> facility).

One partial solution (for those of us using it) would be to make bash's
"tab complete everything" feature aware of security contexts. It's
already pretty powerful (e.g. on an scp it can tab-complete remote
paths, for many programs it can tab-complete commandline parameters,
etc)

Another partial solution are aliases. For example, I have aliases for
ls --context and ps --context.


> Also an audience member asked me if it would be possible to run a machine with 
> all files and processes UID=0, which was a strange co-incidence as I have 
> been planning to do that for play machine ][ (but I may have mentioned it on 
> a mailing list or something and the word may have got around).  This idea 
> seemed to get a lot of interest from the audience, who seemed to actually 
> want to do it as a serious way of running a system (rather than as a fun 
> demonstration of the power of SE Linux).  

Well, essentially it would condense the current 2D matrix we have on
permissions back to a one-dimensional system, only along the other
axis.

It would definitely be interesting for embedded systems, consoles and
other stuff that doesn't really have very much of a user concept. For
example, the iPAQ distribution (familiar) runs everything as root
unless you install some add-on packages.


-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.