Shaz wrote:
Dear list,
I was studying some earlier work on RBAC and came across Kuhn98 [1],
which says that RBAC can be implemented if some interface function is
used to map privilege sets of RBAC with MCS. James Moris blog article
on MCS [2] states that MCS is just dicretionary like DAC if
hierarchies like of MLS levels are not used. It might be because of
the implementation of current LSPP on Linux distros. So my question is
that can RBAC be used with SELinux if the mapping function is provided?
Some further literature or existing work being pointed out will be
appreciated.
Thank you.
[1]
http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/kuhn-98.pdf
[2] http://james-morris.livejournal.com/5583.html
--
Shaz
Im guessing the mapping function is "newrole" right!
if then yeah you should be able too i.g.
newrole -r *_r -- -c /usr/bin/* (or wherever/whatever your
wanting to use in that role).
might get complicated with the sensitivity
levels and categories(that is if you really tweak them).
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
