Re: Java Legacy problem

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Mon, Feb 21, 2005 at 10:12:56AM -0500, Daniel J Walsh wrote:

> My goal is to have a user domain and the equivalent userdomain + legacy 
> stuff.
> 
> So only applications that are marked legacy can do the execmod/execmem 
> stuff.  But have the same privs as any other userdomain
> executable.
> 
> This is one of the things that SELinux does not handle well.    

 no.  *sigh*.  it has to be explicitly spelled out.

> When a 
> user runs this app, add these privs to his existing privs.

 the solutions to this proposed so far [add these privs] have been
 ruled out on the grounds that it is exceptionally difficult to do
 the off-line policy analysis.

 ... which reminds me of another potential solution i thought of.

 you know how linux security modules are stackable, right?

 well... how about stacking policies as well?

 so you could define a list of binary policies that must be
 applied, and the order in which they must be applied, and
 whether (like PAM) they are "sufficient" or "required".


 so you could have _two_ policies, one which allowed legacy
 stuff on user_t _and_ user_java_t (yes, note carefully,
 i said _both_!), and one which allowed legacy stuff on ONLY
 user_java_t.

 the effect of having to go through both policies (which in all other
 respects would be identical) would be that, other than a performance
 hit, you'd end up with the apparent result that user_t is not
 allowed to do legacy stuff, but user_java_t is.


 i believe that the task of "combining" the policy.conf plus the
 rules for off-line auditing checking would be a lot simpler than
 previously proposed solutions.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.