Re: dynamic context transitions

[guttman@mitre.org (Joshua D. Guttman)]

>   I think it will have to be a "read write" flow, i.e. equivalence
>   required, particularly given the possibility of per-thread
>   contexts introduced by this change (one thread may switch to a
>   different context while another is still running in the old one) 

Are you sure that this is a good idea?  If different threads can have
different contexts within the same process, what are you really buying
in security protection?

Wouldn't you really need to know a lot about the possible behavior of
a program in order to know that the threads executing with lower
privileges really can't do harm?  I mean, whatever harm you were
worried about that made you want to give them lower privileges in the
first place?  

Much more complexity isn't worth it (in my opinion), unless you can
really say what  ability you gain to prevent something from going
wrong.  What harm can you really prevent?  

        Joshua 


Stephen Smalley <sds@epoch.ncsc.mil> writes:

>   On Fri, 2004-11-12 at 13:42, Amy L Herzog wrote:
>   > Sorry to jump in a bit late on this. For our information flow analysis
>   > tools, our instinct is to simply expand the LTS we build from the
>   > policy to include the 'process dyntransition' permission (with a
>   > write-like flow, just like the current 'process transition'
>   > permission). Although it would be fairly easy to collapse domains that
>   > have full dynamic transition permissions to one another, doing so
>   > wouldn't affect the truth of any information flow assertions
>   > (i.e. system security goals) in the system.
>   
>   Hmm...I think it will have to be a "read write" flow, i.e. equivalence
>   required, particularly given the possibility of per-thread contexts
>   introduced by this change (one thread may switch to a different context
>   while another is still running in the old one).

-- 
	Joshua D. Guttman		<guttman@mitre.org>
	MITRE, Mail Stop S119		Office:	+1 781 271 2654
	202 Burlington Rd.		Fax:	+1 781 271 8953
	Bedford, MA 01730-1420 USA	Cell:	+1 781 526 5713


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.