Re: dynamic context transitions - a seteuid parallel

[Karl MacMillan <kmacmillan@tresys.com>]

Chad Hanson wrote:

>Luke Kenneth Casson Leighton wrote:
>  
>
>>what are the alternatives?
>>
>>    
>>
>
>The alternatives are to overprivilege the application which is not
>acceptable or to rewrite all of the applications before they can be used on
>this new platform.
>

It is not clear to me how the application is not overprivileged already 
if it is allowed to freely change between a privileged and unprivileged 
domain. The application must be fully trusted with the maximum access 
that it is granted. A misbehaving application will simply not drop 
access (obviously). Additionally, it seems that from an analysis stand 
point, these domains must be treated as equivalent and so it is not 
clear how the argument can be made that this increases assurance.

Karl

>The latter is goal which can and should be achieved or
>time. Applications can streamlined and reorganized to fit into the modular
>framework and of cooperating applications. This is a considerable effort and
>major roadblock to utilizing SELinux and therefore Linux for these types of
>  
>

>The other main roadblocks are already being addressed with Linux getting
>CAPP EAL3 and soon to be EAL4 certifications. Add LSPP and RBAC and you have
>Linux system suitable to address secure information sharing needs.
>
>-Chad
>
>  
>
>>l.
>>
>>p.s. not that i actually understand MLS enough to understand 
>>any answers
>>[yet] but i'm just encouraging people to bounce ideas.
>>
>>
>>    
>>
>
>--
>This message was distributed to subscribers of the selinux mailing list.
>If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
>the words "unsubscribe selinux" without quotes as the message.
>  
>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.