On Mon, 2005-03-28 at 18:20 +0200, Tom wrote: > I think you are right. I did forget about programs launching other > programs. On the other hand, doesn't that give us another option within > SELinux? Can't we make mplayer-launched-by-firefox run in a different > domain than mplayer-run-by-user? In that domain, it would have access > to the downloaded files, but not to the remainder of the user data. Yes, that would make sense to me. -- Stephen Smalley <sds@xxxxxxxxxxxxx> National Security Agency
