link between roles and domains

[Guillaume PETITJEAN <guillaume.petitjean@st.com>]

Hello,

I'm new to SELinux.

I have a question regarding the management of users and roles.

I understood that a user is associated with a role (or several roles) 
and that each role is allowed to enter a set of domain. I understood  
how access control permissions are defined on couple of domains and the 
process of domain transitions. But I didn't understand which domain 
(among the set of domains allowed for a role) is selected at any time.

In other terms let's say you have a process foo belonging to the role 
user_r and suppose user_r is allowed for (domain1_t, domain2_t, 
domain3_t), how does the policy decides to which domain will belong the 
process in practice in order to compute security decisions ?

Thanks

Guillaume Petitjean


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.