Re: [RFC] clarifications for -l to newrole.1

[Casey Schaufler <casey@schaufler-ca.com>]

--- Michael C Thompson <thompsmc@us.ibm.com> wrote:

> Currently, in the MLS policy, the default behaviour
> is to have users 
> login at SystemLow. If this is not what you would
> expect, then we should 
> probably change the default levels assumed for users
> on login.

Allowing users to log in at SystemLow would not
be consistant with current best practice. I know
that neither Trusted Solaris nor Trusted Irix
allows that, and I don't think that HP/UX does
either. Even allowing for the additional
protections provided by TE letting users run with
the same MLS value as system files (unless you
have something lower than low!) is going to
set off warning bells in certain circles. Why
have MLS if you aren't going to use it to
protect your system data, after all? And yes,
I understand that there's lots more to SELinux
policy enforcement than MLS, and that the other
protections are more than sufficient to protect
the system files from users. Even with that,
users should be segregated from the system using
MLS since MLS is available. Belts, bracers,
garters, elastic and velcro make for a happy
and swift evaluation and an end user that
understands how the system is protected.


Casey Schaufler
casey@schaufler-ca.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.