SELinux Coloring book?

[Dominick Grift]

On Wed, 2013-11-13 at 13:10 -0500, Daniel J Walsh wrote:

> > 
> Maybe a followup that describes RBAC.  Not sure how the analogy would work
> though.
> 
> Suggestions welcome.
> 
> Dog Role, See Eye Dog Role, Rescue Dog Role.
> 
> RBAC is always hard to describe especially when you start defining SELinux Users.
> 
> Login User -> SELinux User -> roles -> Types.
> 
> The Russian dolls model is the best I have come up with.
> 
> 

Yes, that makes things a bit more complicated

because if you want to fully explain it then you also get into the
concepts of "automatically transitioning" versus "manually changing"

So for example you want to give the dog the discretion to eat the cat
food as the cat ( by associating the cat role (which in turn is
associated to the cat type) to the dog identity.

Then if the dog wants to eat the cat food like the cat , he can simply
manually change to the cat role with associated cat type

Or you could force the dog to only be able to eat cat food as the cat by
making dog automatically role and type transition on the main entry
point. That way he can only access cat food as a cat (LOL)