Re: Revocation Support

[Joshua Brindle <method@gentoo.org>]

Joshua Brindle wrote:
> Mohammad Mahmoudi wrote:
>> Does SELinux support revocation of permissions?
>>   
> The FLASK architecture, which SELinux is based on, does indeed support 
> revocation by allowing object managers to register callbacks with the 
> security server. However, on SELinux, this is not currently in use. So 
> direct revocation where the object managers actively remove access to 
> objects after a policy change doesn't happen.
>
> However, on some object classes permission is revalidated on every 
> object use (like files and file descriptors). So, even though a 
> process has a file descriptor to a file it previously had access top 
> open, if the permissions change to that file type the next read or 
> write operation will fail which essentially revokes access to it. This 
> should be the case on a file types, fds, sockets, ipc (except shared 
> memory).
>
> Hope this helps..
> <http://us.rd.yahoo.com/mymod/showtimes/X-Men:%20The%20Last%20Stand/SIG=13eg95e87/*https://www.movietickets.com/purchase.asp?afid=myyah&house_id=8612&movie_id=44681&perfd=05282006&perft=23:30> 
>
>
Neat, I dont' know how that link got in my email but it was obviously an 
accident :)


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.