[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: I would like to change the behavior of MCS label creations in directory.



On Wed, Oct 19, 2011 at 11:31, Joshua Brindle <method@xxxxxxxxxxxxxxx> wrote:
> Christopher J. PeBenito wrote:
>> On 10/14/11 11:57, Daniel J Walsh wrote:
>>> Eric and I have come up with the following syntax for this behaviour.
>>>
>>> default_trans level dir_file_class_set parent;
>>
>> I think we want this to be "range" instead of "level", since the field is
>> actually a range.
>>
>>> default_trans user dir_file_class_set process;
>>> default_trans role file parent;
>>
>> Isn't there a better set of tokens than this?  Why not make it
>> default_user, default_role, default_type, and default_range?  Creating an
>> object doesn't really imply a transition, so "trans" seems misleading.
>
> I agree with Chris. This will actually let you make things not transition by
> default so _trans is misleading. Further, "process" shouldn't be a token
> since it is an object class (you couldn't actually parse policy with Eric's
> patches could you?). I don't like "parent" as a token either, and SELinux
> doesn't know anything about processes and parents anyway. SDS's suggestions
> a while back are more appropriate IMO, since SELinux does know what source
> and target are.

Why not extend the behavior of type_transition/range_transition/etc to
allow the existing "self" keyword (maybe with "subject" as a synonym)
and add a new "object" keyword?

IE, allow something like this:
  range_transition myapp_t myapp_data_t:file self;
  range_transition myapp_t myapp_log_t:file object;

Cheers,
Kyle Moffett

-- 
Curious about my work on the Debian powerpcspe port?
I'm keeping a blog here: http://pureperl.blogspot.com/


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.


[Fedora Users]     [Fedora Legacy]     [Fedora Desktop]     [Yosemite Photos]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

Powered by Linux