* mcs design help @ 2015-12-09 18:22 Higgs, Stephen 2015-12-09 18:43 ` Dominick Grift 0 siblings, 1 reply; 6+ messages in thread From: Higgs, Stephen @ 2015-12-09 18:22 UTC (permalink / raw) To: selinux@tycho.nsa.gov Hi All, I'm looking for any implementation suggestions for my following the following: on a database server that restricts logins to confined users, allow selinux users with sysadm_r the ability to administer most aspects of the system, but restrict access to some mysql database files. I approached this by labeling the mysql database files with an mcs category (c127), and then added a domain transition to the mysqld process to run with a context that includes c127. The confined login was configured to initialize with s0:c0. Finally (and I'm really not sure this was the best way), I needed to ensure the administrator could not disable/circumvent selinux so I added the following restriction to the newrole and setenforce binaries (c0.c1023). My test user (also in the sudoers file) can do administrative functions, cannot access the database files, and cannot disable selinux. Any suggestions on how to improve on what I have done? --Stephen ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: mcs design help 2015-12-09 18:22 mcs design help Higgs, Stephen @ 2015-12-09 18:43 ` Dominick Grift 2015-12-09 18:49 ` Higgs, Stephen 0 siblings, 1 reply; 6+ messages in thread From: Dominick Grift @ 2015-12-09 18:43 UTC (permalink / raw) To: Higgs, Stephen; +Cc: selinux@tycho.nsa.gov -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Wed, Dec 09, 2015 at 06:22:17PM +0000, Higgs, Stephen wrote: > Hi All, > > I'm looking for any implementation suggestions for my following the following: on a database server that restricts logins to confined users, allow selinux users with sysadm_r the ability to administer most aspects of the system, but restrict access to some mysql database files. > > I approached this by labeling the mysql database files with an mcs category (c127), and then added a domain transition to the mysqld process to run with a context that includes c127. The confined login was configured to initialize with s0:c0. Finally (and I'm really not sure this was the best way), I needed to ensure the administrator could not disable/circumvent selinux so I added the following restriction to the newrole and setenforce binaries (c0.c1023). > > My test user (also in the sudoers file) can do administrative functions, cannot access the database files, and cannot disable selinux. Any suggestions on how to improve on what I have done? I would not use MCS for this but instead use TE Also i would leave sysadm_r:sysadm_t a generic admin, so i would probably create a custom dbadm_r role. > > --Stephen > > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov. - -- 02DFF788 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 https://sks-keyservers.net/pks/lookup?op=get&search=0x314883A202DFF788 Dominick Grift -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQGcBAEBCgAGBQJWaHZhAAoJENAR6kfG5xmcGeUL/216fJ/2FJjDpW1U/n5BaN13 iUi6v5dH1RrMgaiY4poCJ7rrTn3Wpof7/KwMWjqjxsck9osmCrDvjBPwJuDwzbMe lTUgi1uvcc10TAncWZgnNcf8Tut+TUeOGGIoQ2r7JZNZ5gK/xmNVdWexl8WPydcq eS/vPtglah50MvQk2NowMHV+MLH2gan10WD0sMjAY/H/jq0gLQat4MyTbjQvhPWU qQehPmy9O7rD2Vz71C801B7yQKEq5BJEwU+88a26Nq46qkRvsbTup6jC5fO14MjJ ElOydUKb7kqAkOZLW+QYM9ZI316Qp9CiPsW6AJOe4Mdco9e9x9exPYgdcEI9i9+x JuhmLK2IlfDS98J/6brLRgU8K38YJOc+qaYH1Y5XW3JgAL4djXA+BwhrOg84cgK5 0BY1sC3xwmuvIZuQzAqhtHuM7FaXSaSQemga+oZEeNa8D5PcGxk0aEG+94SQcVg+ Gsy187V9lJ4J+LOQzJYN1kZC082CW+2jBYW/SgZGdQ== =EKw1 -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: mcs design help 2015-12-09 18:43 ` Dominick Grift @ 2015-12-09 18:49 ` Higgs, Stephen 2015-12-09 19:08 ` Dominick Grift 2015-12-09 19:20 ` Mike Palmiotto 0 siblings, 2 replies; 6+ messages in thread From: Higgs, Stephen @ 2015-12-09 18:49 UTC (permalink / raw) To: Dominick Grift; +Cc: selinux@tycho.nsa.gov Thank you, I should also clarify - the generic admin role (sysadm_r) should not have access to the database files (this was the tricky part for me, as the generic admin has a lot of rights), and I am implementing a dbadm_r role that can only administer the database/files. If going with TE, would it mostly be a matter adding an explicit constraint on domain transition to mysqld_t? --Stpehen > -----Original Message----- > From: Dominick Grift [mailto:dac.override@gmail.com] > Sent: Wednesday, December 09, 2015 1:44 PM > To: Higgs, Stephen > Cc: selinux@tycho.nsa.gov > Subject: Re: mcs design help > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > On Wed, Dec 09, 2015 at 06:22:17PM +0000, Higgs, Stephen wrote: > > Hi All, > > > > I'm looking for any implementation suggestions for my following the > following: on a database server that restricts logins to confined users, > allow selinux users with sysadm_r the ability to administer most aspects > of the system, but restrict access to some mysql database files. > > > > I approached this by labeling the mysql database files with an mcs > category (c127), and then added a domain transition to the mysqld > process to run with a context that includes c127. The confined login > was configured to initialize with s0:c0. Finally (and I'm really not > sure this was the best way), I needed to ensure the administrator could > not disable/circumvent selinux so I added the following restriction to > the newrole and setenforce binaries (c0.c1023). > > > > My test user (also in the sudoers file) can do administrative > functions, cannot access the database files, and cannot disable selinux. > Any suggestions on how to improve on what I have done? > > I would not use MCS for this but instead use TE > > Also i would leave sysadm_r:sysadm_t a generic admin, so i would > probably create a custom dbadm_r role. > > > > > --Stephen > > > > _______________________________________________ > > Selinux mailing list > > Selinux@tycho.nsa.gov > > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > > To get help, send an email containing "help" to Selinux- > request@tycho.nsa.gov. > > - -- > 02DFF788 > 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 > https://sks-keyservers.net/pks/lookup?op=get&search=0x314883A202DFF788 > Dominick Grift > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2 > > iQGcBAEBCgAGBQJWaHZhAAoJENAR6kfG5xmcGeUL/216fJ/2FJjDpW1U/n5BaN13 > iUi6v5dH1RrMgaiY4poCJ7rrTn3Wpof7/KwMWjqjxsck9osmCrDvjBPwJuDwzbMe > lTUgi1uvcc10TAncWZgnNcf8Tut+TUeOGGIoQ2r7JZNZ5gK/xmNVdWexl8WPydcq > eS/vPtglah50MvQk2NowMHV+MLH2gan10WD0sMjAY/H/jq0gLQat4MyTbjQvhPWU > qQehPmy9O7rD2Vz71C801B7yQKEq5BJEwU+88a26Nq46qkRvsbTup6jC5fO14MjJ > ElOydUKb7kqAkOZLW+QYM9ZI316Qp9CiPsW6AJOe4Mdco9e9x9exPYgdcEI9i9+x > JuhmLK2IlfDS98J/6brLRgU8K38YJOc+qaYH1Y5XW3JgAL4djXA+BwhrOg84cgK5 > 0BY1sC3xwmuvIZuQzAqhtHuM7FaXSaSQemga+oZEeNa8D5PcGxk0aEG+94SQcVg+ > Gsy187V9lJ4J+LOQzJYN1kZC082CW+2jBYW/SgZGdQ== > =EKw1 > -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: mcs design help 2015-12-09 18:49 ` Higgs, Stephen @ 2015-12-09 19:08 ` Dominick Grift 2015-12-09 19:20 ` Mike Palmiotto 1 sibling, 0 replies; 6+ messages in thread From: Dominick Grift @ 2015-12-09 19:08 UTC (permalink / raw) To: Higgs, Stephen; +Cc: selinux@tycho.nsa.gov -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Wed, Dec 09, 2015 at 06:49:48PM +0000, Higgs, Stephen wrote: > Thank you, I should also clarify - the generic admin role (sysadm_r) should not have access to the database files (this was the tricky part for me, as the generic admin has a lot of rights), and I am implementing a dbadm_r role that can only administer the database/files. As far as i am concerned strictly speaking that breaks the policy model, but if you can imagine it then chances are that you can do. > > If going with TE, would it mostly be a matter adding an explicit constraint on domain transition to mysqld_t? This question is unclear to me. Care to expand? > > --Stpehen > > > -----Original Message----- > > From: Dominick Grift [mailto:dac.override@gmail.com] > > Sent: Wednesday, December 09, 2015 1:44 PM > > To: Higgs, Stephen > > Cc: selinux@tycho.nsa.gov > > Subject: Re: mcs design help > > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA512 > > > > On Wed, Dec 09, 2015 at 06:22:17PM +0000, Higgs, Stephen wrote: > > > Hi All, > > > > > > I'm looking for any implementation suggestions for my following the > > following: on a database server that restricts logins to confined users, > > allow selinux users with sysadm_r the ability to administer most aspects > > of the system, but restrict access to some mysql database files. > > > > > > I approached this by labeling the mysql database files with an mcs > > category (c127), and then added a domain transition to the mysqld > > process to run with a context that includes c127. The confined login > > was configured to initialize with s0:c0. Finally (and I'm really not > > sure this was the best way), I needed to ensure the administrator could > > not disable/circumvent selinux so I added the following restriction to > > the newrole and setenforce binaries (c0.c1023). > > > > > > My test user (also in the sudoers file) can do administrative > > functions, cannot access the database files, and cannot disable selinux. > > Any suggestions on how to improve on what I have done? > > > > I would not use MCS for this but instead use TE > > > > Also i would leave sysadm_r:sysadm_t a generic admin, so i would > > probably create a custom dbadm_r role. > > > > > > > > --Stephen > > > > > > _______________________________________________ > > > Selinux mailing list > > > Selinux@tycho.nsa.gov > > > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > > > To get help, send an email containing "help" to Selinux- > > request@tycho.nsa.gov. > > > > - -- > > 02DFF788 > > 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 > > https://sks-keyservers.net/pks/lookup?op=get&search=0x314883A202DFF788 > > Dominick Grift > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v2 > > > > iQGcBAEBCgAGBQJWaHZhAAoJENAR6kfG5xmcGeUL/216fJ/2FJjDpW1U/n5BaN13 > > iUi6v5dH1RrMgaiY4poCJ7rrTn3Wpof7/KwMWjqjxsck9osmCrDvjBPwJuDwzbMe > > lTUgi1uvcc10TAncWZgnNcf8Tut+TUeOGGIoQ2r7JZNZ5gK/xmNVdWexl8WPydcq > > eS/vPtglah50MvQk2NowMHV+MLH2gan10WD0sMjAY/H/jq0gLQat4MyTbjQvhPWU > > qQehPmy9O7rD2Vz71C801B7yQKEq5BJEwU+88a26Nq46qkRvsbTup6jC5fO14MjJ > > ElOydUKb7kqAkOZLW+QYM9ZI316Qp9CiPsW6AJOe4Mdco9e9x9exPYgdcEI9i9+x > > JuhmLK2IlfDS98J/6brLRgU8K38YJOc+qaYH1Y5XW3JgAL4djXA+BwhrOg84cgK5 > > 0BY1sC3xwmuvIZuQzAqhtHuM7FaXSaSQemga+oZEeNa8D5PcGxk0aEG+94SQcVg+ > > Gsy187V9lJ4J+LOQzJYN1kZC082CW+2jBYW/SgZGdQ== > > =EKw1 > > -----END PGP SIGNATURE----- - -- 02DFF788 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 https://sks-keyservers.net/pks/lookup?op=get&search=0x314883A202DFF788 Dominick Grift -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQGcBAEBCgAGBQJWaHxCAAoJENAR6kfG5xmcm6oL/iq6g3aLlJUFiUqqDUPMHjKo klNDpCQHdwzG8FhdCHw6LQBWuA8KJZ46oKsaZlvN09qroPVCdz0viFkmeVixnUSj VgC+z+1v6HCtPQlj11qrj1T8Q82sBOpQg9gS3BdneIoYmk0Te0BNYFGKpMNgny9b TpbkPlw1uvQF/sLLJHYAvJNy8wkeFjhpACntL8jPzXPYdz2KO+aBkDVy+7QKmhuQ w7DJ8ClLRWqUlgPv+yxfHK7UyVAirRgosqLmI6GINpJdf3ntLlH0dN1JJB8CnSph UE3UIW1UIKo1PlDzeKKXf0uAhFDXxpBwUj8XzN6OuJ7rsealIBPjlxSE4L0XpkvE 5Wd1f/hKZj4o83BD6N/WzAju3qC0zKVZ6HEVzfAaljTla+jQwJPTyyxOwI1Wgv5X jdTqM8jHwo7DHZUqeVi3jt7FQTA555kp/rRkMZZI5ED9O94rpdwm0lQU1+HsX0OL MmLg8fqQueC57PKAu68qrMBLfU3QCoZpDG5i3ENYdg== =tqW/ -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: mcs design help 2015-12-09 18:49 ` Higgs, Stephen 2015-12-09 19:08 ` Dominick Grift @ 2015-12-09 19:20 ` Mike Palmiotto 2015-12-09 19:41 ` Higgs, Stephen 1 sibling, 1 reply; 6+ messages in thread From: Mike Palmiotto @ 2015-12-09 19:20 UTC (permalink / raw) To: Higgs, Stephen; +Cc: Dominick Grift, selinux@tycho.nsa.gov On Wed, Dec 9, 2015 at 1:49 PM, Higgs, Stephen <Stephen.Higgs@icfi.com> wrote: > Thank you, I should also clarify - the generic admin role (sysadm_r) should not have access to the database files (this was the tricky part for me, as the generic admin has a lot of rights), and I am implementing a dbadm_r role that can only administer the database/files. > > If going with TE, would it mostly be a matter adding an explicit constraint on domain transition to mysqld_t? If you go the TE route, you'd be labeling your database files and allowing the mysqld_t type permissions to it through interfaces/allow rules. You'd only associate dbadm_r with mysgld_t, so sysadm_r wouldn't have those permissions. But this brings me to another point... Your design really depends upon which database files you're referring to, exactly. Are these "database files" database-internal objects, or actual external resource files? There are should really be two types of admins (one for internal database objects, and one for external, OS-level files/objects). --Mike > > --Stpehen > >> -----Original Message----- >> From: Dominick Grift [mailto:dac.override@gmail.com] >> Sent: Wednesday, December 09, 2015 1:44 PM >> To: Higgs, Stephen >> Cc: selinux@tycho.nsa.gov >> Subject: Re: mcs design help >> >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA512 >> >> On Wed, Dec 09, 2015 at 06:22:17PM +0000, Higgs, Stephen wrote: >> > Hi All, >> > >> > I'm looking for any implementation suggestions for my following the >> following: on a database server that restricts logins to confined users, >> allow selinux users with sysadm_r the ability to administer most aspects >> of the system, but restrict access to some mysql database files. >> > >> > I approached this by labeling the mysql database files with an mcs >> category (c127), and then added a domain transition to the mysqld >> process to run with a context that includes c127. The confined login >> was configured to initialize with s0:c0. Finally (and I'm really not >> sure this was the best way), I needed to ensure the administrator could >> not disable/circumvent selinux so I added the following restriction to >> the newrole and setenforce binaries (c0.c1023). >> > >> > My test user (also in the sudoers file) can do administrative >> functions, cannot access the database files, and cannot disable selinux. >> Any suggestions on how to improve on what I have done? >> >> I would not use MCS for this but instead use TE >> >> Also i would leave sysadm_r:sysadm_t a generic admin, so i would >> probably create a custom dbadm_r role. >> >> > >> > --Stephen >> > >> > _______________________________________________ >> > Selinux mailing list >> > Selinux@tycho.nsa.gov >> > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >> > To get help, send an email containing "help" to Selinux- >> request@tycho.nsa.gov. >> >> - -- >> 02DFF788 >> 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 >> https://sks-keyservers.net/pks/lookup?op=get&search=0x314883A202DFF788 >> Dominick Grift >> -----BEGIN PGP SIGNATURE----- >> Version: GnuPG v2 >> >> iQGcBAEBCgAGBQJWaHZhAAoJENAR6kfG5xmcGeUL/216fJ/2FJjDpW1U/n5BaN13 >> iUi6v5dH1RrMgaiY4poCJ7rrTn3Wpof7/KwMWjqjxsck9osmCrDvjBPwJuDwzbMe >> lTUgi1uvcc10TAncWZgnNcf8Tut+TUeOGGIoQ2r7JZNZ5gK/xmNVdWexl8WPydcq >> eS/vPtglah50MvQk2NowMHV+MLH2gan10WD0sMjAY/H/jq0gLQat4MyTbjQvhPWU >> qQehPmy9O7rD2Vz71C801B7yQKEq5BJEwU+88a26Nq46qkRvsbTup6jC5fO14MjJ >> ElOydUKb7kqAkOZLW+QYM9ZI316Qp9CiPsW6AJOe4Mdco9e9x9exPYgdcEI9i9+x >> JuhmLK2IlfDS98J/6brLRgU8K38YJOc+qaYH1Y5XW3JgAL4djXA+BwhrOg84cgK5 >> 0BY1sC3xwmuvIZuQzAqhtHuM7FaXSaSQemga+oZEeNa8D5PcGxk0aEG+94SQcVg+ >> Gsy187V9lJ4J+LOQzJYN1kZC082CW+2jBYW/SgZGdQ== >> =EKw1 >> -----END PGP SIGNATURE----- > > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: mcs design help 2015-12-09 19:20 ` Mike Palmiotto @ 2015-12-09 19:41 ` Higgs, Stephen 0 siblings, 0 replies; 6+ messages in thread From: Higgs, Stephen @ 2015-12-09 19:41 UTC (permalink / raw) To: Mike Palmiotto; +Cc: Dominick Grift, selinux@tycho.nsa.gov > -----Original Message----- > From: Mike Palmiotto [mailto:mike.palmiotto@crunchydata.com] > Sent: Wednesday, December 09, 2015 2:21 PM > To: Higgs, Stephen > Cc: Dominick Grift; selinux@tycho.nsa.gov > Subject: Re: mcs design help > > On Wed, Dec 9, 2015 at 1:49 PM, Higgs, Stephen <Stephen.Higgs@icfi.com> > wrote: > > Thank you, I should also clarify - the generic admin role (sysadm_r) > should not have access to the database files (this was the tricky part > for me, as the generic admin has a lot of rights), and I am implementing > a dbadm_r role that can only administer the database/files. > > > > If going with TE, would it mostly be a matter adding an explicit > constraint on domain transition to mysqld_t? > > If you go the TE route, you'd be labeling your database files and > allowing the mysqld_t type permissions to it through interfaces/allow > rules. > You'd only associate dbadm_r with mysgld_t, so sysadm_r wouldn't have > those permissions. > > But this brings me to another point... > > Your design really depends upon which database files you're referring > to, exactly. Are these "database files" database-internal objects, or > actual external resource files? > There are should really be two types of admins (one for internal > database objects, and one for external, OS-level files/objects). > > --Mike > > > > > --Stpehen > > > >> -----Original Message----- > >> From: Dominick Grift [mailto:dac.override@gmail.com] > >> Sent: Wednesday, December 09, 2015 1:44 PM > >> To: Higgs, Stephen > >> Cc: selinux@tycho.nsa.gov > >> Subject: Re: mcs design help > >> > >> -----BEGIN PGP SIGNED MESSAGE----- > >> Hash: SHA512 > >> > >> On Wed, Dec 09, 2015 at 06:22:17PM +0000, Higgs, Stephen wrote: > >> > Hi All, > >> > > >> > I'm looking for any implementation suggestions for my following the > >> following: on a database server that restricts logins to confined > >> users, allow selinux users with sysadm_r the ability to administer > >> most aspects of the system, but restrict access to some mysql > database files. > >> > > >> > I approached this by labeling the mysql database files with an mcs > >> category (c127), and then added a domain transition to the mysqld > >> process to run with a context that includes c127. The confined login > >> was configured to initialize with s0:c0. Finally (and I'm really not > >> sure this was the best way), I needed to ensure the administrator > >> could not disable/circumvent selinux so I added the following > >> restriction to the newrole and setenforce binaries (c0.c1023). > >> > > >> > My test user (also in the sudoers file) can do administrative > >> functions, cannot access the database files, and cannot disable > selinux. > >> Any suggestions on how to improve on what I have done? > >> > >> I would not use MCS for this but instead use TE > >> > >> Also i would leave sysadm_r:sysadm_t a generic admin, so i would > >> probably create a custom dbadm_r role. > >> > >> > > >> > --Stephen > >> > > >> > _______________________________________________ > >> > Selinux mailing list > >> > Selinux@tycho.nsa.gov > >> > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > >> > To get help, send an email containing "help" to Selinux- > >> request@tycho.nsa.gov. > >> > >> - -- > >> 02DFF788 > >> 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 > >> https://sks-keyservers.net/pks/lookup?op=get&search=0x314883A202DFF78 > >> 8 > >> Dominick Grift > >> -----BEGIN PGP SIGNATURE----- > >> Version: GnuPG v2 > >> > >> iQGcBAEBCgAGBQJWaHZhAAoJENAR6kfG5xmcGeUL/216fJ/2FJjDpW1U/n5BaN13 > >> iUi6v5dH1RrMgaiY4poCJ7rrTn3Wpof7/KwMWjqjxsck9osmCrDvjBPwJuDwzbMe > >> lTUgi1uvcc10TAncWZgnNcf8Tut+TUeOGGIoQ2r7JZNZ5gK/xmNVdWexl8WPydcq > >> eS/vPtglah50MvQk2NowMHV+MLH2gan10WD0sMjAY/H/jq0gLQat4MyTbjQvhPWU > >> qQehPmy9O7rD2Vz71C801B7yQKEq5BJEwU+88a26Nq46qkRvsbTup6jC5fO14MjJ > >> ElOydUKb7kqAkOZLW+QYM9ZI316Qp9CiPsW6AJOe4Mdco9e9x9exPYgdcEI9i9+x > >> JuhmLK2IlfDS98J/6brLRgU8K38YJOc+qaYH1Y5XW3JgAL4djXA+BwhrOg84cgK5 > >> 0BY1sC3xwmuvIZuQzAqhtHuM7FaXSaSQemga+oZEeNa8D5PcGxk0aEG+94SQcVg+ > >> Gsy187V9lJ4J+LOQzJYN1kZC082CW+2jBYW/SgZGdQ== > >> =EKw1 > >> -----END PGP SIGNATURE----- > > > > _______________________________________________ > > Selinux mailing list > > Selinux@tycho.nsa.gov > > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > > To get help, send an email containing "help" to Selinux- > request@tycho.nsa.gov. Thanks Dominick and Mike, I get what you're saying; I'm going to give this some more thought. The sysadm_r already has access to mysqld_t, but perhaps making a new type for labeling the database files in /var/lib/mysql/* is the way to go (start from a clean slate where nobody has access). --Stephen ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-12-09 19:41 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2015-12-09 18:22 mcs design help Higgs, Stephen 2015-12-09 18:43 ` Dominick Grift 2015-12-09 18:49 ` Higgs, Stephen 2015-12-09 19:08 ` Dominick Grift 2015-12-09 19:20 ` Mike Palmiotto 2015-12-09 19:41 ` Higgs, Stephen
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.