Re: New to SELinux -- any suggestions?

[Russell Coker <russell@coker.com.au>]

On Sunday 29 October 2006 17:05, Michael Graffam <michael.graffam@gmail.com> 
wrote:
> > If however a file could have multiple types then such analysis would be
> > impossible unless you also had rules determining which pairs of contexts
> > might be applied to one file (in which case every permitted pair of
> > contexts could be mapped to a single context in the current SE Linux
> > system for the same result).
>
> OK, that makes perfect sense. I had figured that multiple contexts would
> be allowed, to prevent the possible need of expanding the number of
> required 'base' contexts. But, I can certainly see your point about the
> difficulty of analyzing all possible combinations.

There are many types used in SE Linux, the number you see in the targeted 
policy is a small part of what is in the strict policy.

Also recently (FC5 and above) the MLS features of SE Linux have been used.  
With separate mechanisms for protecting confidentiality and integrity a 
smaller number of types is needed (previously types were used for 
confidentiality as well).

> Thanks again for your help. Would you happen to know if there is a
> document somewhere which gives a general overview of the structure of
> the SELinux mechanisms, maybe with some details on the common contexts
> and so forth?

Some of this is documented in the Fedora wiki.

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.