I'd like to mark all role-dependent domains with a new attribute $1_domain (analogous to $1_file_type), and then do the following in base_user_macros.te:

can_ps($1, $1_domain)
can_ptrace($1, $1_domain)

Objections?

-- 
Ivan Gyurdiev <ivg2@cornell.edu>
Cornell University


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.