hello,
from http://selinuxproject.org/page/SELinux_models (Multi Category
Security):
[...] Multi Category Security and Multi Level Security are mutually
exclusive.
- MCS and MLS are just particular configurations of constraints for
the
MLS engine and thus share the same field and engine logic. MCS was an
attempt to make the MLS field and engine useful for general users, and
is being leveraged by sandbox and by svirt for separating multiple
instances of sandboxes or guest VMs.
In other words: MCS and MLS are not mutally exclusiv?! Not in SELinux
and not in gernal? For me, MCS in SELinux is an "extra", which you
can use with MLS (or MLS engine) at the same time. Please correct me,
if i'm wrong.
Imho, MCS uses "compartments" or categories to realize the need to
know principle and MLS uses vertical levels to achieve (at least in
SELinux) confidentiality (BLP model). Imo compartments and levels are
not mutally exclusive.
--
Sebastian Pfaff
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
