RE: Alternative user management approach

["Karl MacMillan" <kmacmillan@xxxxxxxxxx>]

> -----Original Message-----
> From: Ivan Gyurdiev [mailto:gyurdiev@xxxxxxxxxx]
> Sent: Friday, June 24, 2005 2:33 PM
> To: Brian T. Sniffen
> Cc: Karl MacMillan; selinux@xxxxxxxxxxxxx
> Subject: Re: Alternative user management approach
> 
> On Fri, 2005-06-24 at 14:09 -0400, Brian T. Sniffen wrote:
> > "Karl MacMillan" <kmacmillan@xxxxxxxxxx> writes:
> >
> > > This makes the SELinux user more what we are calling a 'user
> > > role'. For example, the policy could create 3 user roles with
> > > different role authorizations (which become 'role capabilities'):
> >
> > This seems like a great innovation.  But it does inherit one problem
> > of generic user_u: there's no longer any MAC separating users.  If I'm
> > a normal user, my shell has exactly the same security context as your
> > shell---right?
> 
> Is the user info used for anything besides rbac?
> I don't think it is...
> 

It can be used for constraints. There have been some suggested uses for this,
but none are currently implemented in real policies. User separation seems
better left to DAC.

Karl

---
Karl MacMillan
Tresys Technology
http://www.tresys.com
(410) 290-1411 ext 134



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.