Re: Multiple contexts

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Wed, Jan 12, 2005 at 04:47:41PM -0500, Stephen Smalley wrote:
> On Wed, 2005-01-12 at 15:11, Ivan Gyurdiev wrote:
> > Please explain this some more - Luke also seems confused about this
> > (unless I misunderstand). I don't understand how the change from one
> > context to multiple contexts stored per file translates into policy
> > being encoded in the file attributes.
> > 
> > It seems to me that this change would simply allow more accurate
> > association of the files with the proper security data.
> > 
> > It is still a centralized policy which decides whether to allow an
> > action or not - it just takes into consideration multiple contexts.
> > I am merely suggesting that when a security decision is necessary for
> > a file, all the contexts it is labeled with are provided by the
> > filesystem, and the security server makes a decision based on 
> > whether an access path (not sure of terminology here) exists
> > between the subject context and any object context.
> 
> If we followed that approach, then we wouldn't be able to tell whether
> information can flow from type A to type B without analyzing the
> filesystem state to see what files had multiple contexts and collapsing
> each such combination into a single security equivalence class (type).
 
 would you accept that that could be done at policy compile time,
 and that it would be unnecessary to do that at runtime?

 [if yes, then the question becomes a) who's gonna do the work
  b) is it useable without making selinux horribly complex]

 would you also agree that if someone wants to mess things up
 with chcon then all bets are off for _any_ kind of analysis?

 btw so you aren't thinking of doing something irrational in order
 to stay sane i should point out that i'm not pursuing this to be
 bloody-minded - hopefully you know me better than that by now!

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.