Research
Skip Research Menus
Research MenuSecurity Enhanced Linux What's New Frequently Asked Questions Background Documents License Download Participating Mail List Archives Remaining Work Contributors Related Work Press Releases Information Assurance Research NIARL In-house Research Areas Mathematical Sciences Program Sabbaticals Computer & Information Sciences Research Technology Transfer Advanced Computing Advanced Mathematics Communications & Networking Information Processing Microelectronics Other Technologies Technology Fact Sheets Publications Related Links |
SELinux Mailing ListRE: Policy backward compatibility
From: Karl MacMillan <kmacmillan_at_tresys.com>
Date: Tue, 13 Apr 2004 14:31:10 -0400
It is clear that generating old format binary policies from policy.conf files with significant use of new features is not going to work well. This doesn't mean, however, that checkpolicy shouldn't have the ability to generate an old binary policy format from a policy.conf that doesn't use those features. I think that keeping multiple versions of checkpolicy around (that have to be compiled from separate source trees) is going to be a huge problem. The modutils example is not exactly analogous. In that case it was clear that there were only going to be 2 versions of the utilities. In the checkpolicy case there are going to be at least 3 and likely more. I definitely understand that maintaining backwards compatibility code can be problematic - Apol supports policies as old as pre-version 11, for example. I believe this will be less of a problem than the multiple versions of checkpolicy, though. I suggest that binary compatibility can be dropped from the kernel. It was useful for the conditional policy transition, but I think it can be dropped without too much user pain. I also suggest that the backwards compatibility should be retained in the same way as it is now for checkpolicy. That means that by default checkpolicy only generates the latest version and if the user requests, it will generate a specific older version binary (through the -c VERSION flag). If the policy.conf file they are compiling uses newer features it can take an appropriate action (like dropping the conditional policy) or refuse to generate the policy entirely.
Karl MacMillan
> -- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Tue 13 Apr 2004 - 14:31:41 EDT |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |