Re: intercepting system calls

From: Casey Schaufler (caseyat_private)
Date: Fri Apr 13 2001 - 16:01:33 PDT

  • Next message: David Wagner: "Re: intercepting system calls"

    David Wagner wrote:
    
    > Could you give me a concrete example of a policy where this matters?
    > If we have to go to some lengths to support mediating read and write,
    > do you think this is justified?
    
    In some implementations of Mandatory Access Control
    checks are done on every operation just in case the
    MAC label changed after the open. UNICOS works this
    way, for one. It's not the only way to meet the B1 (LSPP)
    requirements, you can revoke access to files when their
    labels change, or disallow changing labels on open files,
    but it is a legitimate (and commercially successful)
    approach.
    
    -- 
    
    Casey Schaufler				Manager, Trust Technology, SGI
    caseyat_private				voice: 650.933.1634
    casey_pat_private			Pager: 888.220.0607
    
    _______________________________________________
    linux-security-module mailing list
    linux-security-moduleat_private
    http://mail.wirex.com/mailman/listinfo/linux-security-module
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 16:05:38 PDT