Re: Java Legacy problem

[Daniel J Walsh <dwalsh@redhat.com>]

Luke Kenneth Casson Leighton wrote:

>On Sun, Feb 20, 2005 at 10:53:58AM -0500, Ivan Gyurdiev wrote:
>  
>
>>On Sun, 2005-02-20 at 15:44 +0000, Luke Kenneth Casson Leighton wrote:
>>    
>>
>>>if i was dealing with it, i would create a macro - mozilla_java_domain
>>>with an argument $1 which takes the role (see usage of mozilla_domain).
>>>      
>>>
>>Hi Luke. 
>>Perhaps my mail did not make it clear - I am interested in java usage
>>outside mozilla. The mozilla java policy already exists and works.
>>    
>>
>
> ah, right.
>
> okayyy... well, you would do well to follow the same approach
> (but this time with a macro called java_domain),
> such that any program you intend to be capable of using java
> you could use the macro to give that program the rights it
> needs when executing java.
>
> however, the point i believe that is being made is that 1) is
> user_t sufficient protection and if so don't bother 2) be
> careful if you create a new domain that you don't give it
> _more_ rights than user_t is normally allowed.
>
> l.
>  
>

This is a case where we may want to give an application more rights then 
user_t.
The java_user_t should be user_t + (execmem/execmod privs)

>
>--
>This message was distributed to subscribers of the selinux mailing list.
>If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
>the words "unsubscribe selinux" without quotes as the message.
>  
>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.