How to disable/remove MLS

How to disable/remove MLS

[Ioannis Aslanidis]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

Is there a way to disable MLS so that the MLS tag gets removed from the
context?

Thanks in advance.

Regards,

Ioannis Aslanidis
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkhfwfsACgkQFq+8w76sCADLuwCeJ4g3GOx+JCsMO8+iv11iltHs
xC0An2kSe554RxVIPGJ4e+nAQFedG5Ch
=ZDR3
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: How to disable/remove MLS

[Stephen Smalley]

On Mon, 2008-06-23 at 17:32 +0200, Ioannis Aslanidis wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hello,
> 
> Is there a way to disable MLS so that the MLS tag gets removed from the
> context?

Whether or not MLS is enabled is defined by your policy build options.
In refpolicy, this is determined by the TYPE= setting in build.conf.
The upstream refpolicy defaults to "standard", which leaves MLS
disabled.  Fedora and RHEL use "mcs", which enables the MLS engine and
field but only uses categories with a different set of constraints than
"mls".  Fedora and RHEL also run mcstransd, a daemon for label
translation, which by default strips the ":s0" suffixes so that users
don't see them.

Disabling MCS/MLS in Fedora or RHEL may cause compatibility problems.
Such compatibility issues should be reported as bugs, since application
code should remain independent of policy, but such bugs have been
encountered in the past, and most users of Fedora and RHEL only use the
default policy that enables MCS.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: How to disable/remove MLS

[Ioannis Aslanidis]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello and thank you for the reply.

The problem here is that we also work with older systems (FC5) which do
not have MCS implemented and cause compatibility problems when saving
configuration file contexts. Migrating to a newer version is planned,
but it will take a long while. In the meanwhile we need an intermediate
solution.

In RHEL 5.1/5.2 is where I see the ':s0' tag when I do ls -Z. Any clues
about that?

Regards,

Ioannis

Stephen Smalley wrote:
| Whether or not MLS is enabled is defined by your policy build options.
| In refpolicy, this is determined by the TYPE= setting in build.conf.
| The upstream refpolicy defaults to "standard", which leaves MLS
| disabled.  Fedora and RHEL use "mcs", which enables the MLS engine and
| field but only uses categories with a different set of constraints than
| "mls".  Fedora and RHEL also run mcstransd, a daemon for label
| translation, which by default strips the ":s0" suffixes so that users
| don't see them.
|
| Disabling MCS/MLS in Fedora or RHEL may cause compatibility problems.
| Such compatibility issues should be reported as bugs, since application
| code should remain independent of policy, but such bugs have been
| encountered in the past, and most users of Fedora and RHEL only use the
| default policy that enables MCS.
|
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkhfy3IACgkQFq+8w76sCABQmgCfRiawui0m9d6iJhX+an6SqTlq
ge8AoKvM6SfKTOWRHs7zaY37Uhq/qzeF
=1gSQ
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: How to disable/remove MLS

[Stephen Smalley]

On Mon, 2008-06-23 at 18:12 +0200, Ioannis Aslanidis wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hello and thank you for the reply.
> 
> The problem here is that we also work with older systems (FC5) which do
> not have MCS implemented and cause compatibility problems when saving
> configuration file contexts. Migrating to a newer version is planned,
> but it will take a long while. In the meanwhile we need an intermediate
> solution.
> 
> In RHEL 5.1/5.2 is where I see the ':s0' tag when I do ls -Z. Any clues
> about that?

I believe that FC5 and RHEL5 have MCS enabled.  But the :s0 is hidden if
you are running mcstrans.

/sbin/service mcstrans status

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: How to disable/remove MLS

[Ioannis Aslanidis]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thank you, indeed that was it.

Stephen Smalley wrote:
| On Mon, 2008-06-23 at 18:12 +0200, Ioannis Aslanidis wrote:
|> -----BEGIN PGP SIGNED MESSAGE-----
|> Hash: SHA1
|>
|> Hello and thank you for the reply.
|>
|> The problem here is that we also work with older systems (FC5) which do
|> not have MCS implemented and cause compatibility problems when saving
|> configuration file contexts. Migrating to a newer version is planned,
|> but it will take a long while. In the meanwhile we need an intermediate
|> solution.
|>
|> In RHEL 5.1/5.2 is where I see the ':s0' tag when I do ls -Z. Any clues
|> about that?
|
| I believe that FC5 and RHEL5 have MCS enabled.  But the :s0 is hidden if
| you are running mcstrans.
|
| /sbin/service mcstrans status
|
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkhf0V8ACgkQFq+8w76sCAB6sgCgqACjQAjiNN1LzDXvC2T0l5Ws
XsAAn33yCX6ALnQoSGrNkuZ+NpFfghtG
=rtFI
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.