On 6/29/12 5:45 PM, Willy Santos wrote:
CCI-000026 refers to enforcing information flow control using protected processing domains. This mapping is open to discussion and change.



SRG-OS-000010 CCI-000026 The operating system must enforce information flow control using protected processing domains (e.g., domain type-enforcement) as a basis for flow control decisions. Protected processing domains can be used to separate different data types. The operating system must enforce information flow control to ensure information does not pass into domains that are not authorized to process it.

We enforce information flow against processing domains via SELinux. By default we just run everything as unconfined_t. SysAdmins can change this if they want to alter the standard flow, but regardless we enforce it whenever selinux is enforced.

I'd map this to having to enable selinux.