Our initial MLS design and implementation kept things at the same level of granularity as previous MLS implementations. SELinux is far more granular and could support class specific MLS "privileges". TE policy can help prevent unintended use of the "privilege" since a policy may not permit write access to etc_t:s0, even though you have MLS write access running at s1 (from the mlsfilewrite attribute). If we wanted to be more granular in the class specifications, we would need to create the specific interfaces and adjust the MLS constraint file accordingly. If you have patch, we can review it. (I'm going to be unavailable for a little over a week starting on Friday). -Chad > As I said in another post I've added mls interface calls to deal with > these constraint violations. However I'm concerned about the > breath of > the interfaces in that they cover many classes/types of files when as > far as I know the X server really only needs multilevel access to > 'chr_file'. Should there be more class specific interfaces? > -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
