From: Russell Coker <russell@coker.com.au>
To: Albert Cahalan <albert@users.sourceforge.net>,
Stephen Smalley <sds@epoch.ncsc.mil>
Cc: SELinux@tycho.nsa.gov
Subject: Re: threads
Date: Wed, 21 Jan 2004 16:09:05 +1100 [thread overview]
Message-ID: <200401211609.05416.russell@coker.com.au> (raw)
In-Reply-To: <1074647474.953.40407.camel@cube>
On Wed, 21 Jan 2004 12:11, Albert Cahalan <albert@users.sourceforge.net>
wrote:
> > For MAC, per-thread contexts make little sense
> > since you cannot enforce any separation of the memory.
>
> This is not quite right. A server daemon using
> per-thread contexts is clearly within your trusted
> computing base, just as the kernel is. This can
> improve security over the obvious alternative of
> having the server run in a context that can do
> anything.
Also having threads in different contexts may be helpful for file servers.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2004-01-21 5:09 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-12-26 15:54 threads Albert Cahalan
2003-12-29 15:37 ` threads Stephen Smalley
2004-01-21 1:11 ` threads Albert Cahalan
2004-01-21 5:09 ` Russell Coker [this message]
2004-01-21 13:47 ` threads Stephen Smalley
-- strict thread matches above, loose matches on Subject: below --
2005-11-06 6:17 threads Fabio Andres Miranda
2005-11-06 8:41 ` threads Steve Graegert
2001-03-06 23:55 Ying Chen
2001-03-07 0:07 ` threads J . A . Magallon
2000-11-10 15:03 threads M.Kiran Babu
2000-11-10 15:39 ` threads Matti Aarnio
2000-11-10 16:05 ` threads Reto Baettig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200401211609.05416.russell@coker.com.au \
--to=russell@coker.com.au \
--cc=SELinux@tycho.nsa.gov \
--cc=albert@users.sourceforge.net \
--cc=sds@epoch.ncsc.mil \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.