All of lore.kernel.org
 help / color / mirror / Atom feed
From: Michal Svoboda <michal.svoboda@agents.felk.cvut.cz>
To: selinux@tycho.nsa.gov
Subject: Re: MCS and default labels
Date: Wed, 9 Sep 2009 15:59:40 +0200	[thread overview]
Message-ID: <20090909135940.GG24297@myhost.felk.cvut.cz> (raw)
In-Reply-To: <1252503271.13634.669.camel@moss-pluto.epoch.ncsc.mil>

[-- Attachment #1: Type: text/plain, Size: 915 bytes --]

Stephen Smalley wrote:
> > Maybe I am not seeing something after all. Suppose I use the full MLS
> > variant and give a user the labels c1,c2. How exactly would it happen
> > that in a c1 dir he would automatically create c1 files, and in c1,c2
> > dir c1,c2 files?
> 
> He wouldn't.  The first case would violate MLS write-down restrictions.

Ah, I see the point now. In some literature, categories are
discretionary even when sensitivity levels are used. So a s1:c1 process
can write to s1, but not to s0:c1.

> Different people have different views of MCS.  And it hasn't really
> worked out the way it was envisioned.  There has been some discussion of
> this, including during the SELinux summits (minutes are published).

Thanks, I guess I need to read more on that. I've googled the 2007
minutes, but not the other ones. Would you happen to have some links?

Regards,
Michal Svoboda



[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

  reply	other threads:[~2009-09-09 13:59 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-09-08  5:58 MCS and default labels Michal Svoboda
2009-09-08 15:35 ` Stephen Smalley
2009-09-08 16:36   ` Michal Svoboda
2009-09-08 17:10     ` Stephen Smalley
2009-09-09 10:06       ` Michal Svoboda
2009-09-09 12:17         ` Stephen Smalley
2009-09-09 13:19           ` Michal Svoboda
2009-09-09 13:34             ` Stephen Smalley
2009-09-09 13:59               ` Michal Svoboda [this message]
2009-09-09 14:34                 ` Stephen Smalley
2009-09-14  8:19           ` Michal Svoboda
2009-09-14 12:20             ` Stephen Smalley
2009-09-14 13:00               ` Stephen Smalley
2009-09-15  6:32               ` Michal Svoboda
2009-09-15 11:16                 ` Stephen Smalley
2009-09-27  7:34           ` Russell Coker
2009-09-28 13:37             ` Stephen Smalley
2009-09-28 20:57               ` Russell Coker
2009-09-28 23:22               ` Kyle Moffett
2009-09-29 12:21                 ` Stephen Smalley
2009-09-29 13:54                   ` Kyle Moffett
2009-09-29 20:54                     ` Paul Moore
2009-09-30  3:51                       ` Kyle Moffett
2009-09-30 13:19                         ` Paul Moore
2009-09-30 13:49                           ` Kyle Moffett
2009-09-30 14:20                             ` Paul Moore

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20090909135940.GG24297@myhost.felk.cvut.cz \
    --to=michal.svoboda@agents.felk.cvut.cz \
    --cc=selinux@tycho.nsa.gov \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.