Re: Denials from newest kernel

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

Stephen Smalley wrote:
> On Fri, 2006-10-06 at 11:44 -0400, Joshua Brindle wrote:
>   
>
> But in the case where an object inherits the label of another object,
> that is to be expected - we will end up seeing "packets" with the labels
> of associations, which in turn are labels of sockets, which in turn are
> (usually) labels of processes.  No need to turn every check on a
> "packet" into a check on some original class from which its label was
> derived.
>
>   

Agreed.
> Also, the above isn't true of all checks, e.g.
> 	allow ftpd_t ftp_port_t:tcp_socket name_bind;
>
>   

For what its worth I always found that the overloading of the socket 
objects for port checks to be very confusing and difficult to explain.

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.