Re: [redhat-lspp] labeled ipsec policy

[Casey Schaufler <casey@schaufler-ca.com>]

--- Paul Moore <paul.moore@hp.com> wrote:


> Hmmm, I suspect this will probably be a problem as
> the IPsec management tools 
> serve a dual purpose, they control the IPsec
> configuration (sysadm_r) as well 
> as the policy relating to labeling SAs (secadm_r). 
> I guess we'll just have 
> to settle for sysadm_r and deal with the fact that
> sysadm_r is going to have 
> some control over the system's security policy in
> this case.

Alternatively, you might consider a separate
network security administrator role that is
associated with those tools. It might be better
than giving sysadm_r the additional responsibility.


Casey Schaufler
casey@schaufler-ca.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.