Re: Default Policy question?

[Tom <tom@lemuria.org>]

On Mon, Jun 02, 2003 at 01:21:53PM -0400, Stephen Smalley wrote:
> security administrator from the system administrator is difficult unless
> you significantly prune what a typical system administrator can do;
> otherwise, the system administrator can subvert the software,
> configuration or environment of the security administrator and
> effectively take control of it.  

But if the secadm_r controls the policy, he should have enough power at
his hands to prevent subversion. Things he would have to protect:

* his home directory (environment)
* policy and policy tools
* kernel and kernel modules

Other than that, all other tools are limited by the policy, aren't
they? The sysadm_r can replace ls with a trojaned binary, but he can't
make it do anything that the normal ls isn't allowed to do.


Please tell me if I'm wrong - I'm seing if it's possible to define a
set of "core tools", defined essentially as "access to any of these means 
game over". I'm not sure if I can invert the process and say that _no_
access to any of them means system integrity still valid, but it
appears so.


-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.