[rsbac] Trusted Path Execution and scripts

[Jens Kasten]

rsbac has more also models, than what i use.
only to  see if i understand it properly.
a) every binary or file has a rc-type.
b) the user e.g on /home/user1 has rc-type 1000 
c) the user1 has a rc-role 1000
d) every service wich is running has his owne rc-role

than the .bashrc has a different rc-type  e.g 10001
every think the user1 need to login has his owne rc-type so he can login.
than the rc-role 1000 has no execute right on rc-type 1000.
how he would do something bad.
the rc-role 1000 has also not access to the rc-type on /usr/bin/perl.
so mayby he can write in his rc-type 1000 directory some bad thinks,
but this rc-role 1000 can  do nothing. how will he eable to call the perl?
for me unpossible.  remember on all main files or directory has to stay 
rc-types, so that no default is accepted.
so every think under the rc-type 1000 directory is under controll from the 
rsbac and has no default.
  

Am Donnerstag 20 Juli 2006 04:09 schrieb tazok:
> > To perl and python, making them an unique forced role and revoking all
> > execute and read_open privileges to all types not "trusted_scripts" would
> > be enough, but in the case of bash you can't do it, first because you
> > can't forgive the access to it to anyone because they couldn't even
> > logging into the system, you can't forgive the read_open privilege too
> > because it reads for the .bashrc file for example, however this users
> > could write scripts and launch them without control and this is the
> > question that I can't find one solution.
> >
> > Please, substitute forgive by forbid, it was a mistake
>
> _______________________________________________
> rsbac mailing list
> rsbac at rsbac.org
> http://www.rsbac.org/mailman/listinfo/rsbac