On Tue, 2004-06-29 at 12:30, Valdis.Kletnieks@private wrote: > And sites that have some need to implement a "Users/Processes of Type X can't > do Operation Y" to satisfy some local requirement (possibly not easily > expressed in SELinux terms - consider a rule like "Processes run by Graduate > Students may not access the Foo Shared Resource between 9AM and 5PM M-F"...) > may be looking at a *fifth* LSM to implement one or two rules.... You can implement that policy using SELinux and the conditional policy support added by Tresys, i.e. the allow rules granting the graduate student domain access to the foo shared resource type are bracketed with a conditional on a policy boolean, and crond or some similar daemon toggles the boolean value at the appropriate times. -- Stephen Smalley <sds@private> National Security Agency
This archive was generated by hypermail 2b30 : Tue Jun 29 2004 - 09:35:39 PDT