From: "Christopher J. PeBenito" <cpebenito@tresys.com>
To: dE <de.techno@gmail.com>, <selinux@tycho.nsa.gov>
Subject: Re: What's a 'permission map'?
Date: Thu, 10 Jul 2014 12:54:47 -0400 [thread overview]
Message-ID: <53BEC557.7060409@tresys.com> (raw)
In-Reply-To: <53BEBB67.8040804@gmail.com>
On 7/10/2014 12:12 PM, dE wrote:
> On 07/08/14 17:57, Richard Haines wrote:
>> This file is only required when using the "Analysis" tab features. It
>> is fully described
>> in the "Help" - "Information Flow Analysis" tab.
>>
>>
>> APOL will try to find a default in your home directory called
>> .apol_perm_mapping
>>
>> There are various versions in usr/share/setools-3.3
>> (apol_perm_mapping_*). Best to
>> select the latest one and copy to home dir as .apol_perm_mapping to
>> stop it
>> complaining.
>>
>> It will be loaded when you do the first analysis, and can then be
>> modified using
>> "Tools - "View Perm Map".
>>
> After reading these file I've realized that a permission map is
> basically a map of various permissions of various classes to a high
> level r/w/n/b.
>
> Next apol has to convert allow statements in the loaded policy which
> contain class specific permissions to a high level r/w/n/b set of
> permission between types.
>
> But what does apol do when I just feed it the binary policy instead of a
> real permission map?
It always uses the abstract r/w/n/b permissions for the information flow
analysis. The permission map is only used in the information flow
analysis, which is why tools like sesearch don't have permission map
options. If you run an information flow analysis without explicitly
loading a permission map, apol will try to load one, like Richard
describes above, so that the analysis can be performed.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
prev parent reply other threads:[~2014-07-10 16:55 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-07-08 4:53 What's a 'permission map'? dE
2014-07-08 12:23 ` Christopher J. PeBenito
2014-07-10 15:55 ` dE
2014-07-08 12:27 ` Richard Haines
2014-07-10 16:12 ` dE
2014-07-10 16:54 ` Christopher J. PeBenito [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=53BEC557.7060409@tresys.com \
--to=cpebenito@tresys.com \
--cc=de.techno@gmail.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.