From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Fri, 6 Oct 2017 12:14:46 +1100 (AEDT) From: James Morris To: Stephen Smalley cc: selinux@tycho.nsa.gov, paul@paul-moore.com In-Reply-To: <20171002155825.28620-6-sds@tycho.nsa.gov> Message-ID: References: <20171002155825.28620-1-sds@tycho.nsa.gov> <20171002155825.28620-6-sds@tycho.nsa.gov> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Subject: Re: [RFC 05/10] selinux: support per-task/cred selinux namespace List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: On Mon, 2 Oct 2017, Stephen Smalley wrote: > An alternative would be to hang the selinux namespace off of the > user namespace, which itself is associated with the cred. This > seems undesirable however since DAC and MAC are orthogonal, and > there appear to be real use cases where one will want to use selinux > namespaces without user namespaces and vice versa. Indeed, an Oracle use-case is for privileged containers and for this MAC must remain separate. -- James Morris