Re: Problem with semodule mls policy

Stephen Smalley wrote:
> On Wed, 2006-03-15 at 13:00 -0500, Joshua Brindle wrote:
>
>> I can buy this, as well as nodecons having different levels. The strange
>> thing is that you don't know what the levels are exactly, you just know
>> their relationships to each other. ie: eth0 is s1 and eth1 is s5 so eth1
>> is higher sensitivity even though I don't know what that sensitivity
>> means. How big of an issue is this? Chad?
>>
>> writing down files of different levels from within libsemanage means any
>> libsemanage client must be mls trusted, which may or may not be an
>> issue, I'm not sure.
>>
>> So, if this is an issue then both seusers and policy.20 need to be
>> labeled differently.. should this be done through libsemanage config or
>> some appconfig in the policy?
>>
>
> libsemanage could call matchpathcon and just use the returned context,
> as long as we guarantee an initial installed file_contexts file for
> bootstrapping. semanage.conf is not an option I suppose since it now
> lives directly in /etc/selinux and is policy-independent.
>
>

If you don't have an initial file_contexts file at install time, you are going to have a lot more problems than this.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.