How can we setup private user directory that is (recursively) off-limits to anyone but the owner (including root), so long as the policy is being enforced.
These directory trees would be similarly named for all users: "/home_dir_path/Private/" for instance.
On Thu, 2005-05-26 at 09:41 +0300, George J. Jahchan wrote:
How can we setup private user directory that is (recursively) off-limits to anyone but the owner (including root), so long as the policy is being enforced.
These directory trees would be similarly named for all users: "/home_dir_path/Private/" for instance.
First, what do you mean by "root"? An arbitrary uid 0 process like a daemon or setuid application, or an authenticated administrative user? The former is easy to restrict, as it only has the capabilities and permissions allowed by the SELinux policy for its domain. The latter is difficult, as an admin often has legitimate need to access all files (e.g. backup), can subvert the OS (e.g. by installing updated OS software or configuration files that include his own modifications), and can bypass any OS restrictions (e.g. boot from CD or remove the disk and put it into a system under his control).
Second, do you truly want per-user separation or just per- role/domain/level? MAC is more oriented toward the latter. For per- user separation, you have two options: - use the existing Linux DAC support, i.e. set file modes in the usual manner, and only use SELinux to help restrict what processes can override DAC, - define per-user entries in policy/users, define a new file type for these directories, and define a constraint in policy/constraints so that this type may only be accessed by a process with the same SELinux user identity.
Dear, i need to know the current policy for ssh, is there such a policy?
saludos
-- Mai
On 27 May 2005, at 17:55, Ma. Alejandra Castillo M. wrote:
Dear, i need to know the current policy for ssh, is there such a policy?
What kind of policy? SELinux policy? Maintenance/upgrades policy? Please, explain?
PS: Now, in Spanish: ¿Qué tipo de política? ¿La política de SELinux? ¿Política de mantenimiento y actualizaciones? Por favor, explícate mejor.
On Fri, 2005-05-27 at 11:55 -0400, Ma. Alejandra Castillo M. wrote:
Dear, i need to know the current policy for ssh, is there such a policy?
In the strict policy, yes. In the targeted policy, I think it is unconfined.
Ma. Alejandra Castillo M. wrote:
Dear, i need to know the current policy for ssh, is there such a policy?
depends on the selinux-policy you are using. in the (default) targeted policy, sshd runs in the unconfined domain:
[root@tiffy rhds]# ps -AZ|grep sshd user_u:system_r:unconfined_t 4249 ? 00:00:00 sshd [root@tiffy rhds]#
but of course you can use another selinux-policy which has its own domain for sshd, or write your own.
happy day. thorsten
selinux@lists.fedoraproject.org
-
Felipe Alfaro Solana -
George J. Jahchan -
Ma. Alejandra Castillo M. -
Stephen Smalley -
Thorsten Scherf