Re: Latest diffs

[Joe Nall <joe@nall.com>]

On Sep 21, 2006, at 9:49 AM, Joshua Brindle wrote:

> On Thu, 2006-09-21 at 09:08 -0500, Mikel L. Matthews wrote:
>>
>> We have customers that use all of our 1024 categories and want more.
>> They have requested 10,000 categories.

Wow, and I though I was out on the fringes :) Admin must be ugly.

> That is because they are probably using categories as an integrity
> mechanism which is entirely inappropriate for SELinux since TE  
> should be
> used for integrity and mls should only be used for confidentiality. I
> seriously doubt that a reasonable system could have 10000 useful
> categories.

I can't comment on 10K, but 256 is not enough. Imagine a system that
exchanges data with countries, alliances and has dissemination controls
and compartments local to the country the system is in. There are ~243
countries in ISO 3166, there are between 10 and 20 alliances you might
want to exchange data with, there are another dozen common dissemination
controls (eg NOFORN) and there are quite a few compartments. You can get
over 300 bits pretty easily just using bits for confidentiality.

I'm happy with 1024 because it means we will not have to maintain
policy diffs (for this) and explain them to our accreditors.

joe

http://en.wikipedia.org/wiki/ISO_3166-1_alpha-3
http://www.afei.org/news/ddms.pdf (Table C4.T1)
http://metadata.dod.mil/mdr/irs/DDMS/

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.