Re: [PATCH] checkpolicy - nodecon ordering

On Mon, 2004-11-01 at 13:03 -0500, Stephen Smalley wrote:
> On Fri, 2004-10-29 at 10:07, Chad Hanson wrote:
> > I have created a patch which orders nodecon rules from most specific to
> > least specific. We think this functionality can be useful for ease of
> > administration and to protect against accidental misconfiguration.
> >
> > I couldn't find any mention of this topic being brought up before, so I am
> > interested in opinions on this subject.
>
> Good idea, but I don't think that the patch is correct. Should be
> sorting based on the number of bits set in each mask, not their integer
> value, as the simple value may not reflect the actual specificity. Code
> could also be simplified a bit, e.g. setting of newc->next doesn't need
> to be conditional.
>

I agree that this is a good idea - currently it is not possible to put nodecon statements in modules because the ordering in the final policy can't be guarantee. This would make that feasible. I believe that genfs statements have the same problem.

Karl

-- 
Karl MacMillan
Tresys Technology
kmacmillan@tresys.com
http://www.tresys.com


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.