![]() | |||||||||||||
Messages in this thread |
Helge Hafting <helge.hafting@aitel.hist.no> wrote: > Valdis.Kletnieks@vt.edu wrote: > >The part that you managed to miss is that this is MAC - *Mandatory* > >Access Control. This means that the *sysadmin* gets to say "this user > >can't look at that file" - and there's nothing(*) either the owner of the > >file or the user can do about it. There's no chmod or chattr or chacl > >command that the owner can issue to let somebody else read it - that's > >the whole *point* of MAC. > > > >(*) Well.. almost nothing. The owner *may* be able to copy the contents > >of the file to another file that the other user is allowed to read. On the > >other hand, the ability to do this would generally indicate a buggy policy.... > Seems to me there is no use taking away the owners ability to chmod, > precisely because the owner always can get around that. (Unless > the owner doesn't even have the right to read his own file.) No. The point is that a (correct, complete) policy will prevent the user from copying the contents to a file with less protection, by any means. No, I did emphatically /not/ try to imply this is easy to set up (or use). [...] > Company policy may of course forbid the user to bring a camera, just as it > might forbid the user to do "chmod o+r" on important files. I am not > sure that we need the OS to try to enforce such things. If you don't trust your (typically fat-fingered) users and sysadmins... Besides, the point behind the targeted policy in Red Hat/Fedora is to forbid certain daemons to do nasty stuff. It is an additional protection against misconfiguration or processes taken over by crackers. -- Dr. Horst H. von Brand User #22616 counter.li.org Departamento de Informatica Fono: +56 32 654431 Universidad Tecnica Federico Santa Maria +56 32 654239 Casilla 110-V, Valparaiso, Chile Fax: +56 32 797513 - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-10-06 14:43 [from the cache] ©2003-2008 | |||||||||||||