From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: <4E5FD095.3020900@manicmethod.com> Date: Thu, 01 Sep 2011 14:36:05 -0400 From: Joshua Brindle MIME-Version: 1.0 To: Kohei Kaigai CC: Kohei KaiGai , KaiGai Kohei , SE Linux , Stephen Smalley Subject: Re: sepgsql and process transition References: <4E5D2DBA.9060201@manicmethod.com> <4E5E933B.6060604@manicmethod.com> <4E5F9921.6020102@manicmethod.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov Kohei Kaigai wrote: >> trusted procedures are not processes and should not use the process object class. >> > We may need to have an upper meta-level viewpoint. > > When a subject entity appeared in operating system, we call it "process". > When a subject entity appeared in database system, we call it something like "db_client". > And, a subject entity appeared in operating system tries to access database objects, > its security label is dealt with "db_client" class. Hmm. > It isn't that surprising. When processes create sockets they are labeled as the process label by default, files in /proc/ are labeled as the process label. Just because the label is the same doesn't mean the object class is. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.