Re: dynamic context transitions

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Fri, Oct 29, 2004 at 02:10:19PM -0500, Darrel Goeddel wrote:

>       The motivator behind this proposal is to provide a mechanism for a
> trusted application (one written to leverage the security policy) to be
> able to remove unnecessary privileges when they are no longer needed, as
> well as temporarily raise the privilege level to perform certain
> operations and then return to a less privileged level.  

 in principle i like it: in practice i believe it to be seriously
 fraught unless tightly controlled.

 how can you guarantee the circumstances under which security
 "escalation" is done?


 ultimately, i believe it far more sensible for applications to be
 rewritten to take advantage of exec() and the abundantly clear
 context division that entails.

 the less-privileged program exec()s a command which, via
 domain_auto_trans, automatically grants that command more
 privileges.

 if speed is of paramount concern, then the "more" privileged
 executable can be made to run in advance, and dormant: file
 handles can be passed over unix domain sockets between the
 "less" privileged and the "more" privileged program (or
 vice-versa).

 l.

-- 
--
you don't have to BE MAD   | this space    | my brother wanted to join mensa,
  to work, but   IT HELPS  |   for rent    | for an ego trip - and get kicked 
 you feel better!  I AM    | can pay cash  | out for a even bigger one.
--

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.