On Mon, 17 Jan 2005, Darrel Goeddel wrote:

> Replaced the existing MLS logic with a flexible system based on the current
> constraints language.

Do you plan to add support for integrity labels?

What about releasibility labels?

> The compile time options for MLS support have been replaced with runtime
> options/detection.

This looks good from the kernel side, and I don't imagine there will be any real performance issues with all of the runtime checks, given the base impact of SELinux.

One technical nit (in both kernel and user code):

+int mls_setup_user_levels(struct context *fromcon, struct user_datum *user,
+                          struct context *usercon)
+{
+       struct mls_level *fromcon_sen = &(fromcon->range.level[0]);
+       struct mls_level *fromcon_clr = &(fromcon->range.level[1]);
+       struct mls_level *user_low = &(user->range.level[0]);
+       struct mls_level *user_clr = &(user->range.level[1]);
+       struct mls_level *user_def = &(user->dfltlevel);
+       struct mls_level *usercon_sen = &(usercon->range.level[0]);
+       struct mls_level *usercon_clr = &(usercon->range.level[1]);
+
+       if (selinux_mls_enabled) {

The mls_level definitions & assignments should be in the conditional section.

• James -- James Morris <jmorris@redhat.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.