Messages in this thread | | | Date | Fri, 29 Aug 2008 20:47:37 +1000 (EST) | From | James Morris <> | Subject | Re: Frustrated with capabilities.. |
| |
On Fri, 29 Aug 2008, Markku Savela wrote:
> File capabilities (nor selinux) won't work, because the "helper > applications" need to be executed with different capabilities and > permissions, depending on the "manifests" of the downloaded > "code". Obviously, serious permissions are granted only to properly > verified "code" (signed). > > [Any ideas how selinux would help to enforce a permission which is > dynamically defined by installing application?]
You could implement a specialized userpsace application launcher, which parses the manifest, determines a security context for the application, performs any requiste object labeling, then launches the application it in that context. The kernel policy could enforce which particular contexts the launcher was authorized to use, and which applications could be launched in this way, then confine the launched applications.
> > I'm using "code" in quotes, because in my mind, it can include HTML, > word documents, spreadsheets, images. Data formats are getting so > complex, that they start to look more like interpreted code, than plain > passive data. > > File capabilities (and setuid/setgid bits, selinux attributes) have > another problem: they only work properly on internal disk. No sane > person would allow them to be effective from removable media or NFS.
There is a project underway to extend SELinux (and MAC labeling in general) over NFS: http://selinuxproject.org/page/Labeled_NFS
- James -- James Morris <jmorris@namei.org>
| |