On Wed, 2006-03-15 at 11:01 -0500, Joshua Brindle wrote:
> Stephen Smalley wrote:
> > On Wed, 2006-03-15 at 09:26 -0500, Daniel J Walsh wrote:
> >> How do I get semodule to create policy.20 at SystemHigh and everything
> >> other files at SystemLow?
> >
> Why do we want policy.20 at SystemHigh again? The only scenerio I can
> think of is the user->role mappings but who will be using those rather
> than seuser mappings? For that matter, seuser file should probably be at
> SystemHigh...

Possibly local customizations are in view here, e.g. the contents of interfaces.local, that are then fed into the final policy.20 emitted by libsemanage? seusers is the more likely concern, as you note, and it is harder to transparently label it separately since it doesn't live in its own dedicated subdirectory (so range_transition wouldn't help with it; you'd need libsemanage code modification).  

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.