Re: MCS and unconfined_t

[KaiGai Kohei <kaigai@kaigai.gr.jp>]

>>It says an process can transit to more restricted categories only
>>by (h1 dom h2). I felt it's over restriction.
>>For example, a user login with 's0' cannot transit to any wider range
>>categories, even if he would be allowed to belong 's0-s0:c0.c2' at most.
>>
>>I modified my desktop environment (FC5). At a moment, the following
>>configuration seems to me working fine.
>>Do you think it's a reasonable solution ?
> 
> 
> The reason that we need the stronger restriction above is that there is
> not a one-to-one mapping from Linux users to SELinux users, and we are
> now relying on the seusers mapping and initial setup by login to bound
> what is reachable by a given Linux user.

Hmm... a one-to-one mapping between Linux users and SELinux users might
indeed cause managements nightmare.
Please forget my previous proposition.

Thanks Russell for providing modified RPM package. Now I'm using it with
a bit modification removing range_transition of su_exec_t.

By th way, do you think an additional mlsconstrain is necessary for
security : {load_policy setenforce setbool} ?
It also makes MCS invalid, I think.

Thanks,
-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.