Interpret security context

Interpret security context

[Park Lee]

[-- Attachment #1: Type: text/plain, Size: 944 bytes --]

Hi,

In subsection 5.2.1 Object Labeling of <<The Flask Security Architecture: System Support for Diverse Security Policies>>, it says:
   A security context, the first policy-independent data type, is a variable-length string which can be interpreted by any application or user with an understanding of the security policy.
 
        While, In subsection 2.1.Flask Concepts of <<Configuring the SELinux Policy>>, it says:
   The content and format of a security context depends on the particular security model, so a security context is only interpreted by the security server.
 
        Then, Who can interpret the security context except security server? Can any application or user with an understanding of the security policy interpret the security context in the end?
 


--
Best Regards,
Park Lee <parklee_sel@yahoo.com> 
 






		
---------------------------------
Do you Yahoo!?
Win 1 of 4,000 free domain names from Yahoo! Enter now.

[-- Attachment #2: Type: text/html, Size: 1569 bytes --]

Re: Interpret security context

[Stephen Smalley]

On Wed, 2004-09-01 at 10:36, Park Lee wrote:
> Hi,
> In subsection 5.2.1 Object Labeling of <<The Flask Security
> Architecture: System Support for Diverse Security Policies>>, it says:
>    A security context, the first policy-independent data type, is a
> variable-length string which can be interpreted by any application or
> user with an understanding of the security policy.
>  
>         While, In subsection 2.1.Flask Concepts of <<Configuring the
> SELinux Policy>>, it says:
>    The content and format of a security context depends on the
> particular security model, so a security context is only interpreted
> by the security server.
>  
>         Then, Who can interpret the security context except security
> server? Can any application or user with an understanding of the
> security policy interpret the security context in the end?

No conflict there.  The context _can_ be interpreted by anything that
understands the policy; the context _is_ only interpreted by the
security server in the Flask architecture (i.e. it is _not_ interpreted
by the object managers).  The point is that the context intepretation
requires knowledge of the policy, while the object managers are policy
neutral.  
  
-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.