Casey Schaufler: >> Could you give me a concrete example of a policy where this matters? >> If we have to go to some lengths to support mediating read and write, >> do you think this is justified? > >In some implementations of Mandatory Access Control >checks are done on every operation just in case the >MAC label changed after the open. UNICOS works this >way, for one. It's not the only way to meet the B1 (LSPP) >requirements, you can revoke access to files when their >labels change, or disallow changing labels on open files, >but it is a legitimate (and commercially successful) >approach. It is also the approach taken by Sun's Trusted Solaris. -- Darren J Moffat _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 17:10:44 PDT