Re: [RFC]{Patch 0/5] Polyinstantation

["Timothy R. Chavez" <tinytim@us.ibm.com>]

On Wednesday 11 May 2005 12:41, you wrote:

> Suppose a user logs in at UNCLASSIFIED (to read email)
> and while she's there she looks at /tmp/foo. She
> logs off, then logs in at SECRET to do some secret
> work, during which she looks at (a different)
> /tmp/foo. The Powers That Be later decide that
> this user may have been up to no good, and want
> to examine the audit trail associated with her.
> How will the two instances of /tmp/foo be
> differentiated in the audit trail?

I'm not too familiar with MLS, but is it really necessary to audit every thing 
the user is  accessing?  What if /tmp/foo maps to something uninteresting in 
both SECRET and UNCLASSIFIED, do we really care?  If /tmp/foo maps to 
something security-critical and interesting, I'd suspect it will be audited 
(irrespective of namespace, at the inode level), in which case a record will 
be generated with a security context, loginuid, etc.

-tim

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.