Re: dynamic context transitions

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, Nov 02, 2004 at 10:33:17AM -0500, Stephen Smalley wrote:

> Yet even the exec-based transitions are strongly influenced by
> application compatibility concerns; otherwise, we would be purging the
> entire environment, resetting the namespace, etc.  Some would argue that
> exec-based transitions are fundamentally flawed in any case where the
> new domain is more privileged than the calling domain due to the ability
> of the caller to influence the new domain via the implicitly inherited
> state, and an IPC-based model would be preferable so that all
> untrustworthy input is explicitly passed and can be vetted rather than
> implicitly conveyed and so that the initial state of the more trusted
> domain is always setup by a trustworthy process.  


 well... that applies in the instance where selinux isn't involved
 _anyway_ - take any setuid root program as a classic example.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.