SID/Context Mapping

SID/Context Mapping

[I_am alone]

[-- Attachment #1: Type: text/plain, Size: 846 bytes --]



Hi All,

        I am new to the SELinux Enviorment. Just learning by doing a Code Review.

1. What i cant figure out is Where does the SID/Security Context Mapping Occur in the SELinux Source Code . I understand its in the security server (According to Flask Architecture doc)......Hows does it happen. (Examlpes of code part would help).... Is it dynamic everytime the System Restarts ? Or is it Assigned when policy is compiled .. (Compiled Object File contains SID-Context Mapped Data.)........(Bec i put sme print statements to see how does the SID Transition occurs at BPRM Loading ....seems like i get the same SID 4 same processes even i reboot the system .... )


It would be helpful if anyone could clarify it


Thanks & Regards



 

 		
---------------------------------
Stay in the know. Pulse on the new Yahoo.com.  Check it out. 

[-- Attachment #2: Type: text/html, Size: 1002 bytes --]

Re: SID/Context Mapping

[Joshua Brindle]

I_am alone wrote:
>
>
> Hi All,
>
>         I am new to the SELinux Enviorment. Just learning by doing a 
> Code Review.
>
> 1. What i cant figure out is Where does the SID/Security Context 
> Mapping Occur in the SELinux Source Code . I understand its in the 
> security server (According to Flask Architecture doc)......Hows does 
> it happen. (Examlpes of code part would help).... Is it dynamic 
> everytime the System Restarts ? Or is it Assigned when policy is 
> compiled .. (Compiled Object File contains SID-Context Mapped 
> Data.)........(Bec i put sme print statements to see how does the SID 
> Transition occurs at BPRM Loading ....seems like i get the same SID 4 
> same processes even i reboot the system .... )
>
>
Several sids are always going to be the same because the policy defines 
them in a specific order, they are called initial sids, you can look for 
them in the policy source. After the initial sids all sids are generated 
at runtime. In the kernel security/selinux/ss/sidtab.c is where the sids 
are initialized and managed. You'll note that the security server calls 
sidtab_context_to_sid, this searches for the sid associated with the 
context, if it is not present it will insert it into the sidtab.

You can also look at the security server code in libsepol which is 
largely the same as the kernel security server (in terms of 
functionality) but is easier to play with and learn from.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.