| |||||||||||||
SELinuxSELinuxPosted Oct 9, 2009 9:49 UTC (Fri) by michaeljt (subscriber, #39183)In reply to: SELinux by rahulsundaram Parent article: LPC: Three sessions from the security track
I take it that restrictions is a more accurate term here that the "rights" I used above? That is, we are talking about "allowed by default"? And does user ID play no role whatsover? I thought that "role" was important, and that there was a mapping of which UIDs could assume which roles. I was thinking of the "policy and labels" applied to executables when I talked about "binaries with the [SELinux] equivalent of capabilities", did I miss something important?
Thanks again :)
(Log in to post comments)
SELinux Posted Oct 10, 2009 0:22 UTC (Sat) by janfrode (subscriber, #244) [Link]
No, it's "default deny", so the selinux policy adds permissions to do something.
User ID doesn't matter, except that you'll first need to pass the normal owner/group/permissions before selinux is involved (DAC before MAC).
"Roles" I'm not much familiar with..
|
|||||||||||||