Re: [idea] multiple contexts.

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Mon, Jul 26, 2004 at 12:12:03PM -0400, Stephen Smalley wrote:
> On Sat, 2004-07-24 at 19:11, Luke Kenneth Casson Leighton wrote:
> > i'd like to propose an extension to the SE/Linux system: it's quite
> > straightforward and it could possibly be implemented in the macro
> > system - maybe, maybe not.
> > 
> > the ultimate aim is to help simplify the production of policies.
> > 
> > the idea is simple: to be able to have more than one context, and
> > to be able to make auditing decisions based on more than one context.
> 
> Not a good idea, and not necessary.  You can encode the entire call
> chain in a single security context using the domain transitions, 

 well, not entirely - not dynamically, anyway: at least i do not
 believe so.

 i thought originally that it would be possible to do what i envisaged
 with m4, by extending the policy language.


> and can
> then unwind as desired.  Fortunately, it sounds like the kdeinit problem
> is easily solved anyway.

 i also seek to limit the programs that a KDE user may run.

 if there is a simple way to do that which does not involve writing
 policy files for each and every single KDE program i intend to restrict
 users to use, i would be interested to hear it.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.