Re: [patch] screen_macros.te

[Daniel J Walsh <dwalsh@redhat.com>]

Russell Coker wrote:

>On Thursday 06 January 2005 00:21, Daniel J Walsh <dwalsh@redhat.com> wrote:
>  
>
>>I would like to add a new file type cert_t for ssl cert files, since
>>these are defaulted to usr_t right now.
>>Shouldn't these be protected at a higher level?
>>    
>>
>
>Are you talking about protecting the integrity or the secrecy of data in such 
>files?
>
>If integrity then anything which can write to usr_t can break the system 
>anyway.  If secrecy then nothing in an rpm is secret anyway.
>
>If there are certificates that have any secret data then they should be 
>somewhere other than under /usr.
>
>  
>
They are not in an RPM, and there has been discussions that they should 
be moved under /var/ or /etc/.
I think readability is the problem here.  Wherever they end up we need a 
general case protecting the
certificates so ever application that can read /usr or /etc/ or /var can 
not read these files.   We are also going
have to start looking at how we can protect Kerberos Key Files.  But 
that is another conversation.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.