On 6/29/12 5:45 PM, Willy Santos wrote:
CCI-000026 refers to enforcing information flow control using
protected processing domains. This mapping is open to discussion and change.
SRG-OS-000010 CCI-000026 The operating system must enforce information
flow control using protected processing domains (e.g., domain
type-enforcement) as a basis for flow control decisions. Protected
processing domains can be used to separate different data types. The
operating system must enforce information flow control to ensure
information does not pass into domains that are not authorized to
process it.
We enforce information flow against processing domains via SELinux. By
default we just run everything as unconfined_t. SysAdmins can change
this if they want to alter the standard flow, but regardless we enforce
it whenever selinux is enforced.
I'd map this to having to enable selinux.