Re: RBAC with SELinux MCS

["Justin P. Mattock" <justinmattock@gmail.com>]

Shaz wrote:
> Dear list,
>
> I was studying some earlier work on RBAC and came across Kuhn98 [1], 
> which says that RBAC can be implemented if some interface function is 
> used to map privilege sets of RBAC with MCS. James Moris blog article 
> on MCS [2] states that MCS is just dicretionary like DAC if 
> hierarchies like of MLS levels are not used. It might be because of 
> the implementation of current LSPP on Linux distros. So my question is 
> that can RBAC be used with SELinux if the mapping function is provided?
>
> Some further literature or existing work being pointed out will be 
> appreciated.
>
> Thank you.
>
> [1] 
> http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/kuhn-98.pdf
> [2] http://james-morris.livejournal.com/5583.html
>
> -- 
> Shaz
>
Im guessing the mapping function is "newrole" right!
if then yeah you should be able too i.g.
newrole -r  *_r -- -c /usr/bin/* (or wherever/whatever your
wanting to use in that role).
might get complicated with the sensitivity
levels and categories(that is if you really tweak them).

Justin P. Mattock


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.