[redhat-lspp] RBAC Roles

[Steve Grubb]

On Wednesday 21 September 2005 13:45, Stephen Smalley wrote:
> I'm ok with the idea of allowing syscall audit filters to be based on
> contexts and context components, as long as the interpretation is
> handled by SELinux.  That doesn't require regenerating policy.

Yeah, that seemed to be potentially fragile to me. So, if someone needs to 
audit something like: "-a exit,always -S open -F role=secadm -F otype=etc_t"   
what would we need to do? If a policy reload occurs, would we need to have a 
callback to re-adjust the values? Or do we need to lookup secadm and etc_t 
each time?

>And of course, SELinux audits permission denials by default.

We also need to have a way to suppress these audits. FAU_SEL.1 says we have to 
have the ability to exclude events based on sensitivity labels. One idea I 
had was that we could put a filter in audit_log_end, however, the message is 
in text by that time and we may need to do a numeric lookup. How should we 
handle this requirement?

-Steve