banning copying of binaries (e.g. mozilla etc).

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

okay, got a weird issue where i am curious as to whether selinux could
help.

imagine that ipt_owner has been successfully hacked up (hacked as in
the literal and true meaning of the word not the one the press associate
with it) to support program names (or as a last resort inodes) as part
of the checking / filtering rules.

i.e. like fireflier's rather buggy userspace support for allowing
e.g. mozilla to do port 80 and port 445 but NOT any other program,
only done properly and in the kernel.

now imagine that someone bypasses these rules by simply copying the
binary.

in this way, they would be able to at the very least bypass "DENY"
rules.

my question is, therefore, is there an easy way to ban users from
copying binaries, whilst still allowing users to run them?

l.

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.