Re: user guide draft: "SELinux Contexts and Attributes" review

[Murray McAllister <mmcallis@redhat.com>]

Murray McAllister wrote:
> Stephen Smalley wrote:
>> On Fri, 2008-09-05 at 15:46 +1000, Murray McAllister wrote:
>>> Stephen Smalley wrote:
>>>> On Wed, 2008-09-03 at 16:04 +1000, Murray McAllister wrote:
>>>>> How about:
>>>>>
>>>>> The level is an attribute of MLS and Multi-Category Security (MCS). 
>>>>> The first part of the level, s0-s0, is the sensitivity.
>>>> Actually, s0-s0 is a MLS range where the low level has sensitivity s0
>>>> and no categories and the high level has sensitivity s0 and no
>>>> categories.
>>>>
>>>>>  The s0 sensitivity is the only sensitivity used for MCS. Since the 
>>>>> format of the level is the same for MLS and MCS, and MLS supports 
>>>>> ranges of sensitivities, a sensitivity such as s0-s0 is the same as 
>>>>> s0 when using MCS.
>>>> No, s0-s0 is always the same as just s0, regardless of MCS or MLS.  
>>>> Just
>>>> like s1-s1 is the same as just s1.  Versus a non-trivial range like
>>>> s0-s1 or s0-s3.
>>>>
>>>>>  Optionally, the level can have a list of categories.
>>> I hope this is correct soon ;)
>>>
>>> The level is an attribute of MLS and Multi-Category Security (MCS). 
>>> The first part of the level, s0-s0, is an MLS range.
>>
>> s0-s0 is a range.  It is not a level.  A MLS range is a pair of levels
>> (lowlevel, highlevel) written as "lowlevel-highlevel" if they differ or
>> as just "lowlevel" if they are the identical.  Each level is a
>> (sensitivity, categoryset) pair written as "sensitivity:categoryset" or
>> just "sensitivity" if the category set is empty.  A categoryset is a
>> list of categories written as "category1,category2,...".  If a category
>> set contains a contiguous series of categories (e.g.
>> "c1,c2,c3,c4,c5,c6,c7,c8,c9,c10") this can be abbreviated as the first
>> category in the series followed by a dot (".") followed by the last
>> category in the series, e.g. "c1.c10".
>>
>> s0-s0 is a range where the lowlevel == highlevel == (sensitivity s0,
>> emptycategoryset).
>>
> 
> If it is not right this time, it's being deleted ;)
> 
> level: The level[1] is an attribute of MLS and Multi-Category Security 
> (MCS). An MLS range is a pair of levels, written as lowlevel-highlevel 
> if the levels differ, or lowlevel if the levels are identical (s0-s0 is 
> the same as s0). Each level is a sensitivity-category pair, with 
> categories being optional. If there are categories, the level is written 
> as sensitivity:category-set. If there are no categories, it is written 
> as sensitivity. If the category set is a contiguous series, it can be 
> abbreviated. For example, c0.c3 is the same as c0,c1,c2,c3. The 
> /etc/selinux/targeted/setrans.conf file is used to map levels (s0:c0) to 
> human-readable form (CompanyConfidential). 
In Fedora 10, targeted policy enforces MCS, and in MCS, there is only 
one sensitivity, s0. MCS in Fedora 10 supports 1024 different 
categories: c0 through to c1023. s0-s0:c0.c1023 is sensitivity s0, and 
authorized for all categories.

> 
> 
> [1] talking about all of the output (s0-s0:c0.c1023
> ) from semanage login -l
> 
> -- 
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov 
> with
> the words "unsubscribe selinux" without quotes as the message.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.