On Fri, 23 Nov 2001, Giovanni Mugnai wrote:

> I have begun reading about selinux lately, i have read the security policy
> configuration could be changed at runtime by the security_load_policy call.
> I would like to know if it's possible to prevent from security policy
> configuration runtime changes, e.g. by a suitable kernel configuration, and
> where i could read something about.

This call is controlled by the load_policy permission. In the example policy configuration, this permission is only granted to the sysadm_t domain for administrators. If you remove this permission from policy/domains/admin/sysadm.te, then runtime policy changes will no longer be permitted.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.