On Thu, 2007-12-20 at 15:11 -0600, Xavier Toth wrote: > dbus-daemon is running at UNCLASSIFIED-SystemHigh. A number of > processes running at UNCLASSIFIED (my seuers default level) are trying > to use dbus and getting mls constraint avcs. I'm not that familar with > dbus but I was thinking of changing its init script to runcon it at > level UNCLASSIFIED or will that just mess up other things? What are the exact avc messages in question here? There are two instances of the bus, one system-wide and one per-session, so you need to think about both cases. At least the system-wide bus will have to handle connections from clients at different levels. If you are supporting multi-level sessions, then the per-session bus will also have to do that. For connecting to the bus, you have to make the bus' socket a mlstrusted object if you want to allow any level to connect. For preventing two levels from communicating through the bus in violation of MLS policy, you need to write mls constraints on the dbus class. I don't think that has been done since the LSPP work didn't cover the desktop. Running the bus at unclassified will only help with the unclassified clients; any higher level client will then be unable to connect. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
