[lkml]   [2007]   [Aug]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [TOMOYO 14/15] Conditional permission support.

    Pavel Machek wrote:
    > What is that? Language parser in kernel?

    Yes. This is a policy parser in kernel.

    TOMOYO Linux' policy is passed from/to the kernel as a plain text
    (i.e. ASCII printable) file via /proc/tomoyo interface.

    For example, to add a permission to allow /usr/sbin/sshd
    to execute /bin/bash if the authenticated user's uid = 500,
    the administrator runs

    # /bin/cat > /proc/tomoyo/domain_policy << EOF
    select <kernel> /usr/sbin/sshd
    1 /bin/bash if task.uid=500

    and to remove this permission, the administrator runs

    # /bin/cat > /proc/tomoyo/domain_policy << EOF
    select <kernel> /usr/sbin/sshd
    delete 1 /bin/bash if task.uid=500

    The patch [TOMOYO 14/15] handles "if task.uid=500" part.

    No compilation at userspace and
    only difference between old and new policy is written.
    This is similar to LDAP manipulation using LDIF format.

    (To be exact, only programs that are registered in
    /proc/tomoyo/manager can modify policy via /proc/tomoyo interface.
    You need to use /usr/lib/ccs/loadpolicy or something
    instead of /bin/cat .)
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-08-26 04:59    [W:0.040 / U:2.936 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site