Re: paranoid FC3 setup: banning all login access (!)

[David Caplan <dac@tresys.com>]

Luke Kenneth Casson Leighton wrote:
> hi,
> 
> i have a requirement for setting up a server that might even ban
> logins - even admin logins.
> 
> the only things that should be allowed are reboot (ctrl-alt-delete at
> console) and services (e.g apache).
> 
> my question is, therefore: is it possible to _conveniently_
> load a completely different selinux policy file (by typing
> "linux init 3" or other incantation at the grub prompt)
> 
> what i want to be able to do is say to my customer "yes, in
> order to do upgrades and maintenance, you press ctrl-alt-delete,
> selection option 2) on the boot-loader menu, and you will be
> dropped into standard admin mode.  when you are done, reboot
> again and let it go back into 'paranoid' mode")
> 
> can anyone help advise?
> 

How about using a conditional expression (aka "boolean")?  That way you can 
have a whole chunk of plicy that gets turned on only when you need it 
(maintenance mode).  All of the types would always be defined, but the 
rules would only be active when the conditional expression/boolean is 
turned on/off.  That way you also don't run into the labeling insanity you 
might encounter with two distinct policies.

David

-- 
__________________________________

David Caplan     410 290 1411 x105
dac@tresys.com
Tresys Technology, LLC
8840 Stanford Blvd., Suite 2100
Columbia, MD 21045

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.