Re: Multiple contexts

On Wed, Jan 12, 2005 at 01:03:02PM -0500, Stephen Smalley wrote:
> On Wed, 2005-01-12 at 13:18, Luke Kenneth Casson Leighton wrote:
> > sorry.
> >
> > something simple:
> >
> > i am thinking along the lines of more than one file context being
> > associated with a file - that sort of thing.
> >
> > and permission being checked and allowed on either of the contexts.
>
> I already explained why you don't want that - it puts the policy into
> the filesystem state.

 there is of course the other scheme which achieves the same end-result,  but using customised m4 macro-based programs to do it: this scheme  has been raised before.

 namely, to have your apache.fc file and your customthing.fc file,  and to "spew forth" a combined apache_customthing_filetype_t with  some macro preprocessing.

 then your apache.fc is unmodified, it's clean, it can be verified,  upgraded etc...

 l.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.