Re: Ok I plead ignorance to the way MLS works.

[Darrel Goeddel <dgoeddel@TrustedCS.com>]

Daniel J Walsh wrote:
> Playing around with MCS, I see the following problems.
> 
> Should the initialsid of kernel be
> 
> sid kernel     system_u:system_r:kernel_t:s0:c0.c127
> or
> sid kernel     system_u:system_r:kernel_t:s0 - s0:c0.c127
> 
> I would like all the daemon processes in the system to run as "s0", Ie 
> by default not have access to any labeled
> data.  How do I do this?   Am I supposed to use something like:
> range_transition initrc_t httpd_exec_t s0 - s0;
> 
> Trying to use this is giving me a compilation error.

I think you would want to run the kernel would at s0:c0.c127.
Then, do a "range_transition kernel_t init_exec_t s0" to get the whole
of userspace started off with no categories present.  This is a change
from the range_transition that is ifdef'd currently for mls in kernel.te.
Are you going to have "ifdef mcs_policy" like the current
"ifdef mls_policy"?

I'm sure about the compilation error, I did a similar statement with a
toolchain that is are pre-modules - that worked.  I'm updating an FC4 box
now so I at least have something up-to-date.

-- 

Darrel

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.