Re: mcs_systemhigh use

[Andy Warner <warner@rubix.com>]

On 6/10/2010 7:09 PM, Christopher J. PeBenito wrote:
> On Thu, 2010-06-10 at 17:15 +0800, Andy Warner wrote:
>    
>> In the policy for the Trusted RUBIX DBMS, we assign file contexts
>> using the following (only one representative dir, 'backups', shown):
>>
>> ifdef(`enable_mls',`
>> /var/lib/RUBIXdbms/backups(/.*)?
>> gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh)
>> ')
>> ifdef(`enable_mcs',`
>> /var/lib/RUBIXdbms/backups(/.*)?
>> gen_context(system_u:object_r:rubix_backup_t,mcs_systemhigh)
>> ')
>>
>> When using the mls policy, I get the expected level of mls_systemhigh
>> (s15:c0.c1023). But when using the targeted policy, I get an
>> unexpected value for mcs_systemhigh. I would expect to get
>> s0:c0.c1023, but get s0. I have verified this behavior on Fedora 9 and
>> 12. Is my assumption wrong about what mcs_systemhigh should be or am I
>> missing something?
>>
>> Relevant output from 'semanage fcontext -l'
>> /var/lib/RUBIXdbms/backups(/.*)?                   all files
>> system_u:object_r:rubix_backup_t:s0
>>      
> Actually, you shouldn't need any of those ifdefs.  The gen_context()
> macro is sensitive to if MLS or MCS is enabled.  The first parameter is
> the first three fields of the context.  The second parameter is the MLS
> label, and there is a third optional parameter to specify the MCS
> categories for the file (there are no examples in refpolicy).  So this
> is sufficient:
>
> /var/lib/RUBIXdbms/backups(/.*)?     gen_context(system_u:object_r:rubix_backup_t,mls_systemhigh,mcs_allcats)
>
> The thing to note is that gen_context() abstracts away the sensitivity
> (s0) portion of the label, so there is an mcs_allcats macro.
>    

Thanks for the reply. So, then is the mcs_systemhigh basically meaningless?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.