Re: [redhat-lspp] Getting rid of multilevel objects

[Casey Schaufler <casey schaufler-ca com>]

--- Klaus Weidner <klaus atsec com> wrote:

> This gets back to the original question - is there a
> real need in the
> SELinux MLS policy for regular users to access
> multilevel objects other
> than specific exceptions for trusted objects? It
> would simplify analysis
> to get rid of them.

Other than a small list of special cases,
/dev/null, /dev/zero, /dev/tty, ptys, etc,
there is no need for "multilevel objects".


Casey Schaufler
casey schaufler-ca com