Re: [redhat-lspp] How to build test policy now?

Re: [redhat-lspp] How to build test policy now?

[Daniel J Walsh]

Does anyone have a good explanation of the relabelto/relabelfrom 
permissions?

Michael C Thompson wrote:
>
> Hi Dan,
>
> I'm working on the policy tests for our LSPP effort, and i'm wondering 
> if you can either a) explain or b) point me to some documentation 
> (which would be ideal) that explains what the permissions: relabelto, 
> relabelfrom mean. Like I said, if you have a link to some sort of 
> documentation, I'm sure I'll come up with more questions and I 
> wouldn't have to bother you again :)
>
> Thanks,
> Mike 
I don't think I can give you a good explanation.  I have copied this 
Email to the larger list, to get an authoritative description.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [redhat-lspp] How to build test policy now?

[Stephen Smalley]

On Thu, 2006-03-09 at 10:32 -0500, Daniel J Walsh wrote:
> Does anyone have a good explanation of the relabelto/relabelfrom 
> permissions?

For which object class?  For files, relabelfrom means "Can domain D
relabel a file from (i.e. currently in) type T1?" and relabelto means
"Can domain D relabel a file to type T2?", so both checks are applied
upon a file relabeling, where T1 is the original type of the type and T2
is the new type specified by the program.  

Useful documents to look at:
1) Object class and permission summary by Tresys 
http://tresys.com/selinux/obj_perms_help.shtml

2) Implementing SELinux as a LSM tech report
(describes permission checks on a per-hook basis)
http://www.nsa.gov/selinux/papers/module-abs.cfm
Also available in the selinux-doc package (and more
up-to-date there).

3) Integrating Flexible Support... tech report
(describes original design and implementation, including summary tables
of classes, permissions, and what permission checks are applied to what
system calls - not entirely up-to-date with current implementation, but
a good resource nonetheless)
http://www.nsa.gov/selinux/papers/slinux-abs.cfm

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [redhat-lspp] How to build test policy now?

[Stephen Smalley]

On Thu, 2006-03-09 at 10:51 -0500, Stephen Smalley wrote:
> For which object class?  For files, relabelfrom means "Can domain D
> relabel a file from (i.e. currently in) type T1?" and relabelto means
> "Can domain D relabel a file to type T2?", so both checks are applied
> upon a file relabeling, where T1 is the original type of the type

Sorry, the above should be "original type of the file", obviously.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.