* How does SELinux work without roles?
@ 2014-05-19 5:13 dE
2014-05-19 16:54 ` Christopher J. PeBenito
0 siblings, 1 reply; 3+ messages in thread
From: dE @ 2014-05-19 5:13 UTC (permalink / raw)
To: selinux
RBAC is completely optional in SELinux; however there appears to be no
way to specify the allowed types for a particular user without
specifying roles.
Without this, there'll be no enforcement.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: How does SELinux work without roles?
2014-05-19 5:13 How does SELinux work without roles? dE
@ 2014-05-19 16:54 ` Christopher J. PeBenito
2014-05-19 16:52 ` dE
0 siblings, 1 reply; 3+ messages in thread
From: Christopher J. PeBenito @ 2014-05-19 16:54 UTC (permalink / raw)
To: dE, selinux
On 05/19/2014 01:13 AM, dE wrote:
> RBAC is completely optional in SELinux; however there appears to be no way to specify the allowed types for a particular user without specifying roles.
>
> Without this, there'll be no enforcement.
You still need to have user->role and role->type associations, but you can simply have one role and remove any constraints related to roles. You cannot completely disable the RBAC mechanism like you can disable MLS.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: How does SELinux work without roles?
2014-05-19 16:54 ` Christopher J. PeBenito
@ 2014-05-19 16:52 ` dE
0 siblings, 0 replies; 3+ messages in thread
From: dE @ 2014-05-19 16:52 UTC (permalink / raw)
To: selinux
On 05/19/14 22:24, Christopher J. PeBenito wrote:
> On 05/19/2014 01:13 AM, dE wrote:
>> RBAC is completely optional in SELinux; however there appears to be no way to specify the allowed types for a particular user without specifying roles.
>>
>> Without this, there'll be no enforcement.
> You still need to have user->role and role->type associations, but you can simply have one role and remove any constraints related to roles. You cannot completely disable the RBAC mechanism like you can disable MLS.
>
Ok, thanks for clarifying that.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-05-19 16:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-05-19 5:13 How does SELinux work without roles? dE
2014-05-19 16:54 ` Christopher J. PeBenito
2014-05-19 16:52 ` dE
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.