Re: [PATCH] sysctl selinux: Don't look at table->de

James Morris
2007-01-29T15:23:45Z

On Mon, 29 Jan 2007, Stephen Smalley wrote:

> NAK. Mapping all sysctls to a single security label prevents any kind
> of fine-grained security on sysctls, and current policies already make
> use of the current distinctions to limit access to particular sets of
> sysctls to particular processes. As is, I'd expect breakage of current
> systems running SELinux from this patch, because (confined) processes
> that formerly only required access to specific sysctl labels will
> suddenly run into denials on the generic fallback label.

Agreed, 100% NACK.

Please don't just simply remove long-researched & analyzed MAC security
which has been in the kernel for years, which is being used in the field
for high assurance systems, because you neglected to consider it during a
code cleanup.

- James
--
James Morris
<jmorris@namei.org>