Re: How to disable/remove MLS

[Ioannis Aslanidis <iaslanidis@flumotion.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello and thank you for the reply.

The problem here is that we also work with older systems (FC5) which do
not have MCS implemented and cause compatibility problems when saving
configuration file contexts. Migrating to a newer version is planned,
but it will take a long while. In the meanwhile we need an intermediate
solution.

In RHEL 5.1/5.2 is where I see the ':s0' tag when I do ls -Z. Any clues
about that?

Regards,

Ioannis

Stephen Smalley wrote:
| Whether or not MLS is enabled is defined by your policy build options.
| In refpolicy, this is determined by the TYPE= setting in build.conf.
| The upstream refpolicy defaults to "standard", which leaves MLS
| disabled.  Fedora and RHEL use "mcs", which enables the MLS engine and
| field but only uses categories with a different set of constraints than
| "mls".  Fedora and RHEL also run mcstransd, a daemon for label
| translation, which by default strips the ":s0" suffixes so that users
| don't see them.
|
| Disabling MCS/MLS in Fedora or RHEL may cause compatibility problems.
| Such compatibility issues should be reported as bugs, since application
| code should remain independent of policy, but such bugs have been
| encountered in the past, and most users of Fedora and RHEL only use the
| default policy that enables MCS.
|
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkhfy3IACgkQFq+8w76sCABQmgCfRiawui0m9d6iJhX+an6SqTlq
ge8AoKvM6SfKTOWRHs7zaY37Uhq/qzeF
=1gSQ
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.