Re: TE for networked resources

[Joshua Brindle <method@manicmethod.com>]

shahbaz khan wrote:
> I was curious while reading Brindle et al paper on enhancing selinux 
> policy for network domain that do we really need TE for these remote 
> resources. Can't we just do with IBAC and RBAC? We can let the local 
> subjects handle the TE with their own types with respect to the IBAC 
> and RBAC of remote subject. This might be what they call equivalence 
> mechanism. The problems associated with TE are too tough for 
> selinux and current network controls to handle. The solutions will 
> cost too much.
>  
Like Steve said, we want to be able to bind executable code to domains 
most of the time. However, the scheme we proposed leaves the translation 
layer vague intentionally. There is nothing that prevents you from 
making a translation server that only uses IBAC and RBAC.  One potential 
use of this is interacting with non-TE security systems.

> Is there any progress on this work. Let me know because I have also 
> working on this and might be able to assist.

Not as of late. We have the iptools patches in svn but other than that 
nothing much has happened.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.