Re: Security issues with local filesystem caching

[David Howells <dhowells@redhat.com>]

Stephen Smalley <sds@tycho.nsa.gov> wrote:

> > What would such a context value look like?  I don't really know much about
> > configuring SELinux.  Would it just be the name of a security label?
> 
> Yes, just a string.  Same kinds of values that you would see from ls -Z
> output.

So I would have something like this?:

	[/etc/cachefilesd.conf]
	dir /var/fscache
	uid 123
	gid 456
	seclabel system_u:object_r:cachefiles_t:s0
	tag mycache
	brun 17%
	bcull 13%
	bstop 3%
	frun 10%
	fcull 7%
	fstop 3%

> Now, the particular values would be policy-dependent, so you might want
> to push those definitions into a separate config file maintained in the
> policy, similar to /etc/selinux/$SELINUXTYPE/contexts/dbus_contexts and
> the like.

I'm not sure how to do that or how it works:-/

David

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.