Messages in this thread | | | Date | Thu, 30 Mar 2006 10:55:25 -0800 | From | Chris Wright <> | Subject | Re: [RFC] Virtualization steps |
| |
* Stephen Smalley (sds@tycho.nsa.gov) wrote: > FWIW, SELinux now has a notion of a type hierarchy in its policy, so the > root admin can carve out a portion of the policy space and allow less > privileged admins to then define sub-types that are strictly constrained > by what was allowed to the parent type by the root admin. This is > handled in userspace, with the policy mediation performed by a userspace > agent (daemon, policy management server), which then becomes the focal > point for all policy loading.
*nod* this is exactly what I was thinking in terms of container specifying policy. Goes through the system/root container and gets validated before loaded.
thanks, -chris - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |