RE: [Announce][Patch] Enhanced MLS support

Here is a version of the init patch with Steve's suggested fixes.

-----Original Message-----
From: Stephen Smalley [mailto:sds@epoch.ncsc.mil] Sent: Wednesday, March 03, 2004 9:32 AM
To: Chad Hanson
Cc: SE Linux (E-mail); Daniel J Walsh; James Morris Subject: Re: [Announce][Patch] Enhanced MLS support

On Tue, 2004-03-02 at 14:44, Chad Hanson wrote:
> Attached are patches to enable the detection of MLS on a SELinux system.
>
> This consists of an mls object inside of selinuxfs (/selinux/mls), a
library
> call for libselinux (is_selinux_mls_enabled()), and application patches
for
> pam and init. The init patch enables loading of MLS or non-MLS policy
> depending on kernel configuration. The pam patch will ask for the MLS
level
> if a default context is not found.

The init and pam patches will need to go to Dan (cc'd above) for inclusion after we have released a libselinux that includes is_selinux_mls_enabled(). This can happen independently of the kernel support getting into the Fedora kernel, as is_selinux_mls_enabled() will return 0 if /selinux/mls doesn't exist at all. With regard to the init patch, it would likely be cleaner to bracket the snprintf with your test of is_selinux_mls_enabled() and print the entire version string (including -mls suffix if appropriate) once to the policy_file buffer; the separate strncat could theoretically overflow the buffer and is wasteful anyway (having to walk the string again).

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
with
the words "unsubscribe selinux" without quotes as the message.




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



application/octet-stream attachment: sysvinit-selinux-tcs.patch