Re: Groups in the alternative user solution

[Ivan Gyurdiev <gyurdiev@xxxxxxxxxx>]

> Groups are still fundamentally discretionary (group membership is
> usually administratively-defined, but assigning group ownership or group
> ACLs to files is at the discretion of the user or any program he runs).

Yes, but assigning group ownership to files does not translate to
the selinux user corresponding to that group getting access to the
files... Essentially the same group maps to both MAC and DAC access
control.

That groups are already used for various purposes seems beneficial to me
- you can refit your existing grouping system to deal with SELinux
without going through each user individually.

It's true that your group requirements for DAC may not be the same
as for selinux... but we don't know if that's the case.

> > >   Better to require them to manage that mapping
> > > separately.  
> > 
> > Well, that's certainly the easier approach...
> 
> Yes.  Of course, ultimately such a mapping has to allow for distributed
> management too.

That requires writing a different backend for manging those records.
How would the interface work for this - would the caller have to specify
backend, or would the selinux library determine what's appropriate?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.