A few questions

[Stephen Smalley]

On Thu, 2006-09-21 at 10:15 -0400, Christopher J. PeBenito wrote:
> On Thu, 2006-09-21 at 15:07 +0200, Salvo Giuffrida wrote:
> > - What makes the access control of SELinux "mandatory"? The fact that normal 
> > users can't change the security policy?
> 
> Yes.  Policy only is set by the admin.

Mandatory access control implies a bit more than just admin-only policy
(otherwise AppArmor would qualify, as would many other things).  In
particular, we identify three properties for MAC:
- complete mediation (control over all processes and objects),
- complete and accurate basis for security decisions (decisions based on
all security relevant information, and accurately reflecting the
security properties of the process and object),
- administrator-defined policy.

-- 
Stephen Smalley
National Security Agency