Re: [SEPOL][SEMANAGE] Nodecon Support: Try 1

> I guess I need to correct myself, that checkpolicy, not the kernel orders
> the nodecon rules.
>
> http://marc.theaimsgroup.com/?l=selinux&m=109906728301734&w=2
> http://marc.theaimsgroup.com/?l=selinux&m=109968743026327&w=2
> http://cvs.sourceforge.net/viewcvs.py/selinux/nsa/selinux-usr/checkpolicy/po
> licy_parse.y?r1=1.24&r2=1.25
>

Ah, this makes all the difference... then the original plan makes sense, and the patch should work, once ordering is added in the local case. I should be able to make a nodecon spec take precedence by placing it in front of the ocontext_t list, correct?

The ports issue I described stands anyway, list() and iterate() show overlapping ranges, and that will be an issue for nodes as well.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.