On Fri, 2004-11-05 at 10:20 -0500, Stephen Smalley wrote:
> On Fri, 2004-11-05 at 10:04, Darrel Goeddel wrote:
> > The process first needs the ability to perform a dynamic transition ("allow
> > foo_t self:process dyntransition").
>
> You mean "setcurrent", right? dyntransition is the pairwise check, as
> you correctly described later in the same message.
>
> > Since the policy allows for such control, I do not see the need to wait for
> > policy language extensions, or to make dyntransitions a compile-time option to
> > the kernel. Sorry if I got a little long-winded there :)
>
> The only reason I can see for making it a compile-time option is greater
> assurance that it will never be used, much as some people may want to
> disable the selinux= boot parameter, runtime disable, or development
> support options via the existing kernel config options. But I am
> hesitant to do this for an API (ability to write to
> /proc/pid/attr/current), although I suppose one could argue that those
> existing options also affect the API (ability to write to
> /selinux/enforce and /selinux/disable as well as the boot parameters
> themselves). No strong preference either way for me.
>

It seems to depend on whether most distributions are going to compile it in or not. If it is rarely enabled - like MLS - then I would just assume it be compile time. If most distributions expect to turn it on I would rather see it always compiled. Do you anticipate the permissions to always be present - and I assume this will be policy version 19?

Karl

-- 
Karl MacMillan
Tresys Technology
kmacmillan@tresys.com
http://www.tresys.com


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.