attribute definitions

attribute definitions

[Diyab]

Where are the type attributes defined?  I'm trying to find out what 
these attributes give permissions to but I can not find any reference to 
where they are defined.  I've tried grepping the policy for things like 
sysadmfile but all I can find is the use of the attribute, not a definition.

Timothy,

-- 
I put instant coffee in a microwave and almost went back in time.
		-- Steven Wright


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: attribute definitions

[Stephen Smalley]

On Tue, 2003-08-05 at 12:14, Diyab wrote:
> Where are the type attributes defined?  I'm trying to find out what 
> these attributes give permissions to but I can not find any reference to 
> where they are defined.  I've tried grepping the policy for things like 
> sysadmfile but all I can find is the use of the attribute, not a definition.

The type attribute names are declared (by convention only) in
policy/attrib.te, with comments describing their intended purpose. 
Originally, type attribute names were implicitly declared when they were
used in a type declaration, but explicit declarations were later added
and made mandatory to safeguard against errors in type declarations and
to provide a centralized place for reviewing the set of existing
attributes and their intended purpose. 

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: attribute definitions

[David Caplan]

Diyab wrote:

> Where are the type attributes defined?  I'm trying to find out what 
> these attributes give permissions to but I can not find any reference 
> to where they are defined.  I've tried grepping the policy for things 
> like sysadmfile but all I can find is the use of the attribute, not a 
> definition.
>
> Timothy,
>
You can use our analysis tool, apol, to determine the set of types that 
use an attribute or which attributes are assigned to a specific type. 
You can also do regular expression searches on either types or 
attributes and display the appropriate groupings.  The tool is included 
in the SE Linux distribution and available from our web site, 
http://www.tresys.com/selinux.

David

David Caplan
dac@tresys.com



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.