Re: New development
On Monday 12 September 2005 13:12, Linda Knippers wrote:
>>What about auditing based on domain/type if SELinux is
enabled?
>
> I feel like this is LSPP work. In just a CAPP environment there needs to
> be a mechanism for this.
I don't think its strictly related to LSPP since LSPP doesn't need
type enforcement, although it will be there.
I lump all the LSPP/MCS work and tightening the audit system with SE Linux as
"LSPP" work. I don't want to mess with type enforcement until the message
numbering is settled. That decision has the new operators as a pre-requisite.
If new operators can't be done, then the way we filter these will have to be
via a different mechanism.
If a CAPP customer also wanted to audit the apache-related
processes,
they're probably also running with SELinux enabled so that's what I was
thinking of.
Maybe not. Suppose they are doing large database system. They may decide to
turn SE Linux off. We really cannot depend on that since they are free to
boot with it on or off. This has to stand on its own.
>> Would that just be for messages that are unique for LSPP?
Do you have
>> an example?
>
> Yes, the cups printer messages is one place.
But would that really be an LSPP message type?
Yes. Its not needed at all for CAPP.
What if MCS users want to audit the cups activity?
MCS is virtually the same configuration as LSPP - just a simplified policy.
But from our perspective in the audit system, it is LSPP. We need to have the
labels in the audit messages.
Maybe I'm taking the LSPP type too literally?
We don't have a CAPP message type today so that's why I'm
confused about the purpose of an LSPP type.
Right now, I consider everything CAPP. The SE Linux messages I'm still mulling
over their classification. They could arguably go either way. All new SE
Linux messages for the support of MCS and LSPP would fall into the LSPP
category.
-Steve