RE: nscd

On Mon, 25 Feb 2002, Westerman, Mark wrote:

> I agree that the example policy configuration needs to be modified
> such that domains are contained completely with in a xxxx.te file.

We can't provide "complete" encapsulation of each domain, since domains interact with each other directly (transitions, signals, IPC) and indirectly (via shared files). In cases where you have a rule involving two domains or where you have a rule involving a domain and a type derived from another domain, the optimal location for the rule isn't always clear (and it doesn't always fit an easy convention, e.g. always place the rule in the source domain's .te file or always place the rule in the target domain's .te file). Of course, with good policy tools, it should be possible to easily generate lists of rules from either viewpoint (e.g. show me all domains that can transition to domain X, show me all domains to which domain X can transition).

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.