Re: password policy question

[JANAK DESAI <janak@us.ibm.com>]

Stephen Smalley wrote:

>On Wed, 2006-01-25 at 10:04 -0500, JANAK DESAI wrote:
>  
>
>>Hello,
>>
>>I am looking at the serefpolicy-2.2.2 (downloaded this morning from 
>>fedora core
>>development SRPMS) and am trying to figure out how, in an mls 
>>environment, a
>>user logged in at anything other s0 would be able to change his/her 
>>password. I
>>expected to see a "typeattribute passwd_t mlsfilewrite" in the 
>>monolithic policy.conf
>>file that I generated. What am I missing?
>>    
>>
>
>Is that really what you want?  It would allow a high process to
>downgrade information via the passwd file.
>
>  
>
What happens if you have user that is defined with mls range of
s3 to s9. How would this user change their password? Looking at
the password policy, I couldn't figure out how that would work.

-Janak

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.