From: Paul Moore <paul@paul-moore.com>
To: jwcart2 <jwcart2@tycho.nsa.gov>,
Joshua Brindle <joshua.brindle@crunchydata.com>
Cc: selinux@vger.kernel.org
Subject: Re: [Non-DoD Source] [PATCH v4] Add default_range glblub support
Date: Wed, 11 Sep 2019 19:52:48 -0400 [thread overview]
Message-ID: <CAHC9VhQXf=h2BhaWvnwdJkLMHUdEV8F5pL4TSqAu6UkL3_FWpg@mail.gmail.com> (raw)
In-Reply-To: <0ea96cc4-11bb-5c4a-5f0a-75411a58e546@tycho.nsa.gov>
On Tue, Sep 10, 2019 at 1:27 PM jwcart2 <jwcart2@tycho.nsa.gov> wrote:
> On 9/9/19 2:05 PM, Joshua Brindle wrote:
> > Policy developers can set a default_range default to glblub and
> > computed contexts will be the intersection of the ranges of the
> > source and target contexts. This can be used by MLS userspace
> > object managers to find the range of clearances that two contexts
> > have in common. An example usage is computing a transition between
> > the network context and the context of a user logging into an MLS
> > application.
> >
> > For example, one can add a default with
> > this cil:
> >
> > (defaultrange db_table glblub)
> >
> > or in te (base module only):
> >
> > default_range db_table glblub;
> >
> > and then test using the compute_create utility:
> >
> > $ ./compute_create system_u:system_r:kernel_t:s0:c1,c2,c5-s0:c1.c20 system_u:system_r:kernel_t:s0:c0.c20-s0:c0.c36 db_table
> > system_u:object_r:kernel_t:s0:c1,c2,c5-s0:c1.c20
> >
> > Some example range transitions are:
> >
> > User Permitted Range | Network Device Label | Computed Label
> > ---------------------|----------------------|----------------
> > s0-s1:c0.c12 | s0 | s0
> > s0-s1:c0.c12 | s0-s1:c0.c1023 | s0-s1:c0.c12
> > s0-s4:c0.c512 | s1-s1:c0.c1023 | s1-s1:c0.c512
> > s0-s15:c0,c2 | s4-s6:c0.c128 | s4-s6:c0,c2
> > s0-s4 | s2-s6 | s2-s4
> > s0-s4 | s5-s8 | INVALID
> > s5-s8 | s0-s4 | INVALID
> >
> > Signed-off-by: Joshua Brindle <joshua.brindle@crunchydata.com>
>
> Merged.
> Thanks,
> Jim
Thanks guys. We're at -rc8 for the kernel right now so it's a little
late to pull the corresponding kernel patch, but I'll do that after
the merge window closes.
--
paul moore
www.paul-moore.com
next prev parent reply other threads:[~2019-09-11 23:53 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-09 18:05 [PATCH v4] Add default_range glblub support Joshua Brindle
2019-09-10 17:22 ` [Non-DoD Source] " jwcart2
2019-09-11 23:52 ` Paul Moore [this message]
2019-10-04 20:10 ` Stephen Smalley
2019-10-04 21:27 ` Paul Moore
2019-10-07 23:08 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhQXf=h2BhaWvnwdJkLMHUdEV8F5pL4TSqAu6UkL3_FWpg@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=joshua.brindle@crunchydata.com \
--cc=jwcart2@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.