Re: X server won't start using MLS policy

[Daniel J Walsh <dwalsh@redhat.com>]

Stephen Smalley wrote:
> On Wed, 2007-04-11 at 15:35 -0400, Mark Webb wrote:
>   
>> Sorry about the HTML.  I sometimes forget Gmail defaults to HTML.
>> One question for you, will running audit2allow 'break' the MLS posture
>> of the machine?
>>     
>
> Hmmm...per your messages file, gdm-binary is running in initrc_t,
> whereas it would normally be running in xdm_t.  Looks like the -mls
> policy in Fedora doesn't even include the definitions for the X-related
> domains (unlike the -strict policy).  So I think you need to build your
> own policy from upstream refpolicy if you want X support.
>
> Running audit2allow won't affect the MLS constraints, but the real
> question is whether you can actually use X in a MLS environment without
> XACE/XSELinux; you'd be limited to single-level-at-a-time desktop.
>
>   
MLS Policy does not include any of the X-Windows or Desktop Client 
modules.  So X is not supported on a MLS/LSPP machine.  Getting a 
Desktop Client to work would require work on XACE/XSELinux as well as 
changes to many other apps like gconf/orbits etc.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.