Lines Matching refs:that
8 control that includes simplicity in its primary design goals.
23 works best with file systems that support extended attributes,
29 access to systems that use them as Smack does.
70 The extended attributes that Smack uses are:
75 of the process that created it.
77 The Smack label of a process that execs a program file with
87 the Smack rule (more below) that permitted the write access
171 label hosts only from processes that have Smack write access
189 permissions that are not allowed. The string "r-x--" would
201 permissions that are not allowed. The string "r-x--" would
226 that have Smack write access to the host label. All packets
231 as a host that supports CIPSO headers.
240 0 - default: this is the policy that relies on Smack access rules.
243 1 - exact: this is the policy that limits PTRACE_ATTACH. Attach is
247 exception that it can't be overridden with CAP_SYS_PTRACE.
250 rules with that subject label.
254 Thereafter, accesses that involve that label will be logged and
255 the access permitted if it wouldn't be otherwise. Note that this
297 or programs that have access to pieces of data.
311 This scheme organizes users, programs, and data into domains that are
332 pick up. There are four terms that are used in a specific way and that are
345 Label: Data that identifies the Mandatory Access Control
349 community. There are also some terms from Linux that are likely to crop up:
351 Capability: A task that possesses a capability has permission to
353 the specific capability. A task that possesses one or more
357 Privilege: A task that is allowed to violate the system security
372 Single character labels using special characters, that being anything
415 6. Any access requested that is explicitly defined in the loaded
437 of access allowed. The access specification is searched for letters that
440 a: indicates that append access should be granted.
441 r: indicates that read access should be granted.
442 w: indicates that write access should be granted.
443 x: indicates that execute access should be granted.
444 t: indicates that the rule requests transmutation.
445 b: indicates that the rule should be reported for bring-up.
466 with the same label specifying a rule for that case is pointless. Only
469 as "ar". A lone dash is used to specify that no access should be allowed.
481 and devices require access permissions that closely match those used by mode
486 directory. It is possible that a user may be able to see that a file exists
492 access rule that allows a process to create an object in that directory
493 includes 't' access the label assigned to the new object will be that
503 them is the same Smack label that the task would use for its own access
506 and writing. Creating a new task is an internal operation that results in two
510 one process to another requires that the sender have write access to the
547 packet received is expected to have a CIPSO tag that identifies the label and
549 is delivered a check is made to determine that a subject with the label on the
550 packet has write access to the receiving process and if that is not the case
558 intervention. Unlabeled packets that come into the system will be given the
561 Smack requires configuration in the case where packets from a system that is
562 not Smack that speaks CIPSO may be encountered. Usually this will be a Trusted
566 of systems that use compatible labeling schemes, and the DOI specified on the
567 Smack system must match that of the remote system or packets will be
594 CIPSO level is used to indicate that the category set passed in the packet is
601 There are two attributes that are associated with sockets. These attributes
606 program that will enforce policy may set this to the star label.
614 You will often find that your labeled application has to talk to the outside,
620 It means that your application will have unlabeled access to @IP1 if it has
644 There are three sorts of applications that will run on a Smack system. How an
663 These are special programs that not only know about Smack, but participate in
664 the enforcement of system policy. In most cases these are the programs that
665 set up user sessions. There are also network services that provide information
707 smackfsdef=label: specifies the label to give files that lack
713 smackfshat=label: specifies a label that must have read access to
734 that triggered the event, plus other pairs depending on the type of event
739 Bringup mode provides logging features that can make application
742 mode is enabled accesses that succeed due to rules marked with the "b"
745 tracking of which rules actual get used for that label.
748 a label to /sys/fs/smackfs/unconfined makes subjects with that label
749 able to access any object, and objects with that label accessible to
750 all subjects. Any access that is granted because a label is unconfined