Re: dynamic context transitions

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Fri, Oct 29, 2004 at 10:18:09PM +0100, Luke Kenneth Casson Leighton wrote:
> On Fri, Oct 29, 2004 at 02:10:19PM -0500, Darrel Goeddel wrote:
> 
> >       The motivator behind this proposal is to provide a mechanism for a
> > trusted application (one written to leverage the security policy) to be
> > able to remove unnecessary privileges when they are no longer needed, as
> > well as temporarily raise the privilege level to perform certain
> > operations and then return to a less privileged level.  
> 
>  in principle i like it: in practice i believe it to be seriously
>  fraught unless tightly controlled.
> 
>  how can you guarantee the circumstances under which security
>  "escalation" is done?

 okay.

 the bit that i don't like is the possibility of a process giving itself
 an uncontrolled amount of access rights.

 what guarantees can you offer that a process can only escalate to a
 specific alternative set of access rights?

 e.g. is your proposal a bit like the file_contexts "alternate"
 keyword idea, where the policy contains a different context that
 the process can flip to?

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.