| |||||||||||||
No surpriseNo surprisePosted Dec 9, 2010 13:53 UTC (Thu) by spender (subscriber, #23067)Parent article: Pathname-based hooks for SELinux?
Somehow escaping the inode/pathname discussion, I've been using the hybrid approach in grsecurity's RBAC system since it was created and even before it had role support. I knew since the beginning it was an important common-case situation for both usability and policy enforcement. Good to hear people are catching up with what I was doing in 2001.
-Brad
(Log in to post comments)
No surprise Posted Dec 11, 2010 22:20 UTC (Sat) by drag (subscriber, #31333) [Link]
From a user/admin standpoint it never made much sense to me that the same data in a file system could have multiple different permissions associated with it. It's just asking for trouble if I could have a filename that was only root readable on one hand, but have the same data world writable on the other hand just based on how they are referenced in the directory tree.
This does seem like the right way to go.
|
|||||||||||||