Re: suggestion to help transition to selinux: dynamic loading of libselinux

[Russell Coker <russell@coker.com.au>]

On Wed, 19 May 2004 00:19, "Chris Babcock" <cbabcock@luthresearch.com> wrote:
> > Until the policy is loaded there are no SE Linux constraints on the
> > machine
> > state.  However at that time only init is running so it shouldn't be a
> > problem.
>
> The danger involved with replacement of /lib/libselinux.so on an selinux
> system is pretty obvious, however if the system is operating properly it
> shouldn't be too much of an issue.
>
> What I was thinking about was more along the lines of what happens on a
> system where a vendor distributes selinux enabled utilities (using dlopen
> as described) but doesn't install the library by default and leaves
> selinux disabled in kernel.

If the vendor in question does not install libselinux then the are designing 
their system to be only protected by Unix permissions.  To create a file 
in /lib you have to have UID 0, so again anyone who can install libselinux 
has already taken over the system.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.