Cc: Crispin Cowan <crispin@...>, Dr. David Alan Gilbert <linux@...>, Arjan van de Ven <arjan@...>, Linux Kernel Mailing List <linux-kernel@...>, LSM ML <linux-security-module@...>, apparmor-dev <apparmor-dev@...>
This is the same sort of thing we are trying to do in SELinux with the
policy management server
<http://oss.tresys.com/projects/policy-server/wiki/PolicyServerDesign>,
ofcourse the policy management server enforces SELinux policy on what
can be changed and what can't. We devised a scheme to allow the policy
to become more restrictive without being able to change the policy
'intent' using a type hierarchy.
In fact I was talking to a coworker today about how this could be done
with smack, using the same kind of hierarchy and allowing unprivileged
users (eg., those without MAC_OVERRIDE) to create new smack labels
'under' their own which would be restricted. This is interesting because
of the ability to create new smack domains on the fly but since only
privileged users can do it it is of limited use. Imagine if a user could
create a new domain for their webbrowser or anything else they care to.
Since they can't add rules to the policy it would effectively just be a
user sandbox, an interesting use indeed.
-
