On Thu, 2007-12-13 at 15:36 +0000, David Howells wrote:
> Stephen Smalley <[email protected]> wrote:
>
> > It is just a way of carving up the permission space, typically based on
> > object type, but it can essentially be arbitrary. The check in this
> > case seems specific to cachefiles since it is controlling an operation
> > on the /dev/cachefiles interface that only applies to cachefiles
> > internal operations, so making a cachefiles class seems reasonable.
>
> Can you specify what sort of permissions you're thinking of providing for
> tasks to operate on this class?
They would correspond with the operations provided by
the /dev/cachefiles interface, at the granularity you want to support
distinctions to be made. Could just be a single 'setcontext' permission
if that is all you want to control distinctly, or could be a permission
per operation.
> Can an object of this class 'operate' on
> other objects, or can only process-class objects do that?
In this case, I wouldn't expect a cachefiles object to act on anything
else. Some objects are also used as subjects, especially in the
networking arena.
> How does an object of this class acquire a label? What is an object of this
> class? Is it a "cache"? Or were you thinking of a "module"?
I was thinking the latter since the only goal was to control what
contexts could be set by a given task, but you could support per-cache
"objects" with their own labels (in which case the label would likely be
determined from the creating task).
If the latter, you don't really need a label for the object, and can
just use the supplied context/secid as the object of the permission
check, ala:
rc = avc_has_perm(tsec->sid, secid, SECCLASS_CACHEFILES,
CACHEFILES__SETCONTEXT);
If the former, then you'd need more than one check, as you then have to
check whether the task can act on the cache in question, and then check
whether it can set the context for that cache to the specified value.
--
Stephen Smalley
National Security Agency
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
