| Main Archive Page > Month Archives > selinux archives |
Re: secadm question
From: Stephen Smalley <sds_at_nospam>Date: Fri Feb 15 2008 - 15:27:32 GMT
To: Paul Moore <paul.moore@hp.com>
On Fri, 2008-02-15 at 10:18 -0500, Paul Moore wrote:
> On Friday 15 February 2008 10:09:47 am Jeremiah Jahn wrote:
> > So if I change my build.conf to be mls I should be up and running.
> > I'm on RHEL5 btw
>
> Yes, setting the TYPE to "mls" should enable the secadm_r role. If you
> don't need the latest Reference Policy, there is a MLS policy as part
> of RHEL5 - it's what was used for the recent (okay, maybe not that
> recent anymore) Common Criteria LSPP evaluations.
Using the -mls policy from RHEL5 is somewhat limiting as it excludes various parts of the policy not covered by the evaluation (e.g. little things like X Window System support). -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.