[lkml]   [2007]   [Oct]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] Version 3 (2.6.23-rc8) Smack: Simplified Mandatory Access Control Kernel
    > My very practical question:  How do I run selinux in one container,
    > and SMACK in another?

    In the LSM model you don't because you could have the same container
    objects visible in different contains at the same time and subject to
    different LSMs. What does it mean to pass an SELinux protected object
    over an AppArmour protected unix domain socket into a SMACK protected
    container ?

    If you want consistency then you probably need to put the container id
    into the LSM calls and provide the ability in one system to do container
    specific checks. Right now I suspect the way to do it is to complete the
    work to convert SMACK rulesets into SELinux rulesets with tools.

    Really its the same problem as "I'd like to use different file permission
    systems on different process identifiers" and it would be very hard to
    get right simply because objects can pass between two different security

    Pyramid tried to do the "simple" case of BSD and System 5 on the same box
    and got caught out even with that because of the different rules on stuff
    like chgrp..
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-10-08 23:19    [W:0.019 / U:59.884 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site