MCS and unconfined_t

[KaiGai Kohei <kaigai@kaigai.gr.jp>]

Hello,

Today, I'm considering an configuration for Fedora core 5 using MCS.

Some users are associated with restricted category 'c0,c1' at most.
If user field in security context would not change, they cannot
transit to wider range of categories.

But they can login with unconfined_t domain in default.
Because unconfined_t domain has 'execcon' permission, they can
transit to discretional range of categories by re-writing the
user field in security context.

Is it possible to control the unconfined_t processes by MCS ?
It seems a bit difficult.
Please notice me, if I have misunderstanding or misconfiguration.

Thanks,

---- current configuration ----
'ymj' logins with 'officer:system_r:unconfined_t:President'.
He can transit to 'user_t:system_t:unconfined_t:God' via an evil
program calls setexeccon().
It makes all MCS configuration nonsense.

[root@ayu ~]# semanage translation -l

Level                     Translation

s0
s0-s0:c0                  Executive
s0-s0:c0,c1               President
s0-s0:c0.c255             God
s0:c0                     Secret
s0:c0,c1                  TopSecret
[root@ayu ~]# semanage user -l

                MLS/       MLS/
SELinux User    MCS Level  MCS Range        SELinux Roles

officer         s0         President        system_r
root            s0         God              sysadm_r user_r system_r
system_u        s0         God              system_r
user_u          s0         God              sysadm_r user_r system_r
[root@ayu ~]# semanage login -l

Login Name                SELinux User              MLS/MCS Range

__default__               user_u                    s0
root                      root                      God
tak                       officer                   Executive
ymj                       officer                   President
[root@ayu ~]#

-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.