> On Jun 09, 2007, at 12:46:40,
david@lang.hm wrote:
>> On Sat, 9 Jun 2007, Kyle Moffett wrote:
>> > Typical "targetted" policies leave all user logins as unrestricted,
>> > adding security for daemons but not getting in the way of users who would
>> > otherwise turn SELinux off. On the other hand, a targeted policy has a
>> > "trusted" type for user logins which is explicitly allowed access to
>> > everything.
>>
>> Ok, it sounds as if I did misunderstand SELinux. I thought that by labeling
>> the individual files you couldn't do the 'only restrict apache' type of
>> thing.
>>
>> > That said, if you actually want your system to *work* with any
>> > default-deny policy then you have to describe EVERYTHING anyways. How
>> > exactly do you expect AppArmor to "work" if you don't allow users to run
>> > "/bin/passwd", for example.
>>
>> for AA you don't try to define permissions for every executable, and ones
>> that you don't define policy are unrestricted.
>>
>> so as I understand this with SELinux you will have lots of labels around
>> your system (more as you lock down the system more) you need to define
>> policy so that your unrestricted users must have access to every label, and
>> every time you create a new label you need to go back to all your policies
>> to see if the new label needs to be allowed from that policy
>
> Actually, it's easier than that. There are type attributes which may be
> assigned to an arbitrary set of types, and each "type" field in an access
> rule may use either a type or an attribute. So you don't actually need to
> modify existing rules when adding new types, you just add the appropriate
> existing attributes to your new type. For example, you could set up a
> "logfile" attribute which allows logrotate to archive old versions and allows
> audit-admin users to modify/delete them, then whenever you need to add a new
> logfile you just declare the "my_foo_log_t" type to have the "logfile"
> attribute.
