Complexity
Posted Sep 23, 2004 16:19 UTC (Thu) by
bkw1a (subscriber, #4101)
In reply to:
Complexity by walters
Parent article:
An introduction to SELinux
> Fundamentally, you need a new system.
How about permissions+capabilities? In the good old VMS days we had
file permissions and process "privileges". Users were granted certain
privileges as part of their account setup, but a process could drop
its privileges. Privileges included things like the ability to do
low-level I/O to disks, or the ability to create new users.
The idea was that you had a set of per-file "permissions" (similar to
Unix's rwxrwxrwx for "owner", "group" and "other", but adding "system")
and an orthogonal set of per-process "privileges" (similar to
"capabilities" in Linux -- which may or may not still be supported).
Together, they allowed pretty fine-grained control over what processes
could do.
This obviously wouldn't do everything that SElinux does, but I wonder
if it might be a useful paradigm for designing a user-friendly
front-end for SElinux, useful for getting simple jobs done quickly.
(
Log in to post comments)
