New development

[Steve Grubb]

On Monday 12 September 2005 13:12, Linda Knippers wrote:
> >>What about auditing based on domain/type if SELinux is enabled?
> >
> > I feel like this is LSPP work. In just a CAPP environment there needs to
> > be a mechanism for this.
>
> I don't think its strictly related to LSPP since LSPP doesn't need
> type enforcement, although it will be there.

I lump all the LSPP/MCS work and tightening the audit system with SE Linux as 
"LSPP" work. I don't want to mess with type enforcement until the message 
numbering is settled. That decision has the new operators as a pre-requisite. 
If new operators can't be done, then the way we filter these will have to be 
via a different mechanism.

> If a CAPP customer also wanted to audit the apache-related processes,
> they're probably also running with SELinux enabled so that's what I was
> thinking of. 

Maybe not. Suppose they are doing large database system. They may decide to 
turn SE Linux off. We really cannot depend on that since they are free to 
boot with it on or off. This has to stand on its own.

> >> Would that just be for messages that are unique for LSPP?  Do you have
> >> an example?
> >
> > Yes, the cups printer messages is one place.
>
> But would that really be an LSPP message type?

Yes. Its not needed at all for CAPP.

> What if MCS users want to audit the cups activity?

MCS is virtually the same configuration as LSPP - just a simplified policy. 
But from our perspective in the audit system, it is LSPP. We need to have the 
labels in the audit messages.

> Maybe I'm taking the LSPP type too literally?

> We don't have a CAPP message type today so that's why I'm 
> confused about the purpose of an LSPP type.

Right now, I consider everything CAPP. The SE Linux messages I'm still mulling 
over their classification. They could arguably go either way. All new SE 
Linux messages for the support of MCS and LSPP would fall into the LSPP 
category.

-Steve