Messages in this thread | | | Date | Fri, 3 Nov 2006 23:12:14 -0500 (EST) | From | James Morris <> | Subject | Re: [PATCH 1/1] security: introduce fs caps |
| |
On Fri, 3 Nov 2006, Kyle Moffett wrote:
> capabilities anyways. I guess it _can_ be done, but why? It's possible to > set up an SELinux system so that there aren't even any SUID binaries, right? > /etc/passwd can run as whatever random user and it will automatically > transition to the appropriate domain such that it can read and modify > /etc/shadow.
SELinux will not override DAC permissions. You can theoretically configure a system with no effective DAC security and just use MAC, but it is definitely not advised.
- James -- James Morris <jmorris@namei.org> - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |