Re: Presidency of user/role/type permissions.

[Daniel J Walsh <dwalsh@redhat.com>]

On 05/13/2014 08:26 AM, Christopher J. PeBenito wrote:
> On 05/13/2014 05:48 AM, dE wrote:
>> For a process's security context (user, role, type), there maybe a conflict in the policy. for e.g. for user user_u, access to the kernel's ring buffer may not be allowed, but for role role_r, it may be allowed. The same process will have user_u and role_r.
>>
>> So in case of conflicting permissions between user, role and type who's permission will the security server respect -- user's, role's or type's?
> First, obviously, the access has to be allowed via type enforcement allow rule.  After that, the constraints can reduce the access.  All of the constraints have to be passed for the end result to be allowed, regardless of what is involved in the constraint (user, role, etc.)  There is no precedence in the constraints.
>
Users and Roles do not control access, only types and MCS/MLS Levels.

Users are a way of assinging  Roles and MCS/MLS ranges to a login user.
Roles control which types are available, then types control access. 
As Chris says MCS/MLS constraints can further restrict a label.