* Capabilities in SELinux
@ 2004-01-20 17:57 Carlos Anísio Monteiro
2004-01-20 20:29 ` Russell Coker
0 siblings, 1 reply; 2+ messages in thread
From: Carlos Anísio Monteiro @ 2004-01-20 17:57 UTC (permalink / raw)
To: selinux
Helo.
I have a doubt about the use of the capabilities in the SELinux.
Why to use capabilities (setuid, setgid, etc) in the SELinux, if the
identity of the user is irrelevant ?
Very thanks.
--
Carlos Anisio Monteiro <monteiro@ipen.br>
IPEN/CNEN-SP
Sao Paulo - Brasil
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Capabilities in SELinux
2004-01-20 17:57 Capabilities in SELinux Carlos Anísio Monteiro
@ 2004-01-20 20:29 ` Russell Coker
0 siblings, 0 replies; 2+ messages in thread
From: Russell Coker @ 2004-01-20 20:29 UTC (permalink / raw)
To: Carlos Anísio Monteiro, selinux
On Wed, 21 Jan 2004 04:57, Carlos Anísio Monteiro <monteiro@ipen.br> wrote:
> I have a doubt about the use of the capabilities in the SELinux.
>
> Why to use capabilities (setuid, setgid, etc) in the SELinux, if the
> identity of the user is irrelevant ?
The UID of the user is not relevant to SE Linux access controls. SE Linux
maintains it's own concept of user "Identity" which is used as part of it's
process of determining when to grant access.
The UID is important for DAC (Unix permissions). When running SE Linux you
will often want to have two users with different Unix UIDs in the same SE
Linux role, but not grant them full access to each other's files.
Restricting setuid and setgid is useful for this.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2004-01-20 20:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-01-20 17:57 Capabilities in SELinux Carlos Anísio Monteiro
2004-01-20 20:29 ` Russell Coker
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.