On Nov 03, 2006, at 15:47:06, Serge E. Hallyn wrote:
Quoting Stephen Smalley ([email protected]):
On Fri, 2006-11-03 at 14:00 -0600, Serge E. Hallyn wrote:
One question is, if this were to be tested in -mm, do we want to
keep
this mutually exclusive from selinux through config, or should
selinux
stack on top of this?
Given that SELinux already stacks with capability and you aren't
using
the security fields (last I looked), it would seem trivial to enable
stacking with fscaps (just add a few secondary_ops calls to the
SELinux
hooks, right?).
Yup, I just wasn't sure if there would be actual objections to the
idea of enabling both at once.
I'll send out a patch - just as soon as I figure out where I left
the src to begin with :)
To be honest from my understanding of SELinux there is no need at all
to use FS caps on an SELinux system. Anything that could be done
with FS caps would be done in a much more fine-grained method with
SELinux, and the inheritance of filesystem-based capabilities should
be masked by SELinux-allowed capabilities anyways. I guess it _can_
be done, but why? It's possible to set up an SELinux system so that
there aren't even any SUID binaries, right? /etc/passwd can run as
whatever random user and it will automatically transition to the
appropriate domain such that it can read and modify /etc/shadow.
Cheers,
Kyle Moffett
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
