Re: Preview of changes to the Security susbystem for 2.6.36

[Tetsuo Handa]

Valdis.Kletnieks@xxxxxx wrote:
> Are you sure you weren't running in permissive mode when you tested this?
I'm running CentOS5.5 and RHEL6beta in enforcing mode with default configuration
(TARGETED policy).

> I am unable to replicate this behavior on my system with SELinux set to
> enforcing mode.  However, it does happen (which is to be expected) when SELinux
> is set to permissive mode.
So, MLS policy can stop this case, can't it? That's fine.

But most people is using TARGETED policy, isn't it?
How do you provide protection to those who don't use MLS policy?

SSHD case is just an example which everyone can try handily.
What I want to say is that it is up to application that how the application
uses information if the application is allowed to access the information. Thus,
we should try to control parameters that affect how the information is used
as much as possible in addition to controlling whether the application can
reach the information or not.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/