Research
Skip Research Menus
Research MenuSecurity Enhanced Linux What's New Frequently Asked Questions Background Documents License Download Participating Mail List Archives Remaining Work Contributors Related Work Press Releases Information Assurance Research NIARL In-house Research Areas Mathematical Sciences Program Sabbaticals Computer & Information Sciences Research Technology Transfer Advanced Computing Advanced Mathematics Communications & Networking Information Processing Microelectronics Other Technologies Technology Fact Sheets Publications Related Links |
SELinux Mailing ListRE: [RFC & PATCH] inherited type definition.
From: Karl MacMillan <kmacmillan_at_tresys.com>
Date: Wed, 16 Mar 2005 16:46:00 -0500
> -----Original Message----- I am looking for a semantic that is part of the binary format - putting it in a macro makes it happen at compile time and therefore isn't useful for production systems without source.
> $1_t extends $1_something_t 'staff_ssh_t extends user_ssh_t'? Again, I don't want to give staff_ssh_t access to user_home_ssh_t which the above statement would, I want to give staff_ssh_t access to staff_home_ssh_t. I want to pattern the access between two or more types on the access of two or more types. More generally, I want to be able to define an access template that can be expanded in the binary policy so that, for example, adding a role will create the appropriate set of types with the correct relationship. In a lot of ways, this is moving a subset of the macro language into the binary format with some additional syntax to say expand this macro for this type, type prefix, all roles, etc. This could also be used to address the same things that the EXTEND syntax does with more control and flexibility, though it would require changes to the existing policy similar to converting a policy into macros (the passwd_t, groupadd_t, etc macro is a good example). Karl
> l. --- Karl MacMillan Tresys Technology http://www.tresys.com (410) 290-1411 ext 134 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Wed 16 Mar 2005 - 16:52:29 EST |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |