On Mon, 4 Jun 2001, Casey Schaufler wrote: > Err, it was on the selinux list. Someone wants a policy > which modifies the DAC policy under certain MAC conditions. > It was something on the order of "users cleared for TS > can read UNCLASS data regardless of the file permissions." > You can't do that if the traditional DAC checks are done > outside the policy module. I've previously suggested (both on this list and on the selinux list) that it would be nice to be able to provide this kind of functionality (typically using Type Enforcement, not MLS, e.g. a process in the FOO domain can override discretionary read restrictions on files with the BAR type). By replacing the guts of capable() with a call to the LSM hook, I get halfway there - I can allow a process in the FOO domain to override discretionary read restrictions on all files. The per-file override ability would be nice, but it isn't on our critical path - we would be willing to wait for the next generation of LSM in Linux for it. -- Stephen D. Smalley, NAI Labs ssmalleyat_private _______________________________________________ linux-security-module mailing list linux-security-moduleat_private http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Mon Jun 04 2001 - 11:41:39 PDT