From: Daniel J Walsh <dwalsh@redhat.com>
To: Colin Walters <walters@verbum.org>
Cc: selinux@tycho.nsa.gov
Subject: Re: Groups in the alternative user solution
Date: Tue, 05 Jul 2005 15:40:16 -0400 [thread overview]
Message-ID: <42CAE220.9060802@redhat.com> (raw)
In-Reply-To: <1120592032.16262.5.camel@nexus.verbum.private>
Colin Walters wrote:
>On Tue, 2005-07-05 at 15:15 -0400, Daniel J Walsh wrote:
>
>
>
>>This would potentially eliminate the 1000's of file contexts files problem,
>>since almost all users would map to the default user_r and user_home_t...
>>for his home dir file context.
>>
>>
>
>But isn't a large part of the point of this to ensure that e.g. grissom
>can never access medical records stored in welby's home directory, even
>if welby accidentally sets the DAC permissions to allow it? Or is
>something else in this scheme preventing that?
>
>
>
I would argue that medical records should never be stored in a users
home directory.
The idea here is that the application to view medical records would not
be able to be run
by the ordinary user.
--
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2005-07-05 19:42 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-06-28 17:34 Groups in the alternative user solution Ivan Gyurdiev
2005-06-28 19:44 ` Stephen Smalley
2005-06-28 19:50 ` Ivan Gyurdiev
2005-06-29 14:35 ` Stephen Smalley
2005-06-29 15:05 ` Ivan Gyurdiev
2005-06-29 15:38 ` Stephen Smalley
2005-06-30 13:27 ` Ivan Gyurdiev
2005-06-30 13:46 ` Stephen Smalley
2005-06-30 15:54 ` Casey Schaufler
2005-06-30 16:06 ` Ivan Gyurdiev
2005-06-30 19:14 ` Casey Schaufler
2005-07-05 19:15 ` Daniel J Walsh
2005-07-05 19:33 ` Colin Walters
2005-07-05 19:40 ` Daniel J Walsh [this message]
2005-07-05 20:01 ` Karl MacMillan
2005-07-05 20:19 ` Daniel J Walsh
2005-07-05 20:22 ` Ivan Gyurdiev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=42CAE220.9060802@redhat.com \
--to=dwalsh@redhat.com \
--cc=selinux@tycho.nsa.gov \
--cc=walters@verbum.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.