[lkml]   [2007]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC] TOMOYO Linux
2007/6/13, Stephen Smalley <>:
> On Wed, 2007-06-13 at 17:13 +0900, Toshiharu Harada wrote:
> > Here are examples:
> > /bin/bash process invoked from mingetty: /sbin/mingetty /bin/bash
> > /bin/bash process invoked from sshd: /usr/sbin/sshd /bin/bash
> > /bin/bash process invoked from /bin/bash which was invoked from sshd: /usr/sbin/sshd /bin/bash /bin/bash
> Why can't you do this via SELinux domain transitions? That lets you do
> it by equivalence class rather than per-binary, and let's you just
> encode the security-relevant parts of the "invocation history" aka call
> chain. For example, the above could be expressed in SELinux policy
> already as:
> domain_auto_trans(getty_t, shell_exec_t, local_shell_t)
> domain_auto_trans(sshd_t, shell_exec_t, remote_shell_t)
> domain_auto_trans(remote_shell_t, shell_exec_t, remote_subshell_t)
> or whatever you like. But you don't have to keep extending it
> indefinitely when you don't need to distinguish in policy, so you might
> choose to entirely omit the last one, and just have it stay in
> remote_shell_t.

The above SELinux policy looks similar to the one I wrote, but
that is not very true. Because in my example, path name corresponds to a file
while local_shell_t are bound to multiple.
I understand the advantages of label, but it needs to be
translated to human understandable form of path name.
So I think pathname based call chains are advantages for
at least auditing and profiling.

Toshiharu Harada
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2007-06-13 16:25    [W:0.072 / U:0.876 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site