On Thu, 11 Jan 2001, Christoph Hellwig wrote:

> > It is also quite different
> > from POSIX.1e mandatory access controls, which are tied to a
> > specific kind of mandatory security policy.
>
> Capabilities and mac are of course different, otherwise you probably
> won't find them in the same posix standard...

I guess my antecedent was ambiguous. I was trying to say that the SELinux mandatory access controls are quite different from POSIX.1e mandatory access controls, because SELinux provides a flexible mandatory access control architecture that can support many different kinds of security policies while POSIX.1e is limited to a particular kind of security policy (multi-level security, and perhaps Biba integrity or other lattice-based models). SELinux can support lattice-based models like multi-level security, but it can also support Type Enforcement, Role-Based Access Control, and other models. So POSIX.1e MAC only does a subset of what SELinux does.

--
Stephen D. Smalley, NAI Labs
sds@tislabs.com



--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.