Re: file context ordering

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Thu, 2005-07-28 at 13:58 -0700, Ron Kuris wrote:
> My suggestion:
> 
> Use M4 diversions to raise the priority of the more important rules.
> M4 will output diverted text at the end of the script, and you can
> prioritize each section this way.
> 
> This worked perfectly for me when I had a similar problem:
> 
> divert(3)
> [ insert selinux rules here ]
> divert(0)
> 
> The rules between the diverts will be output at the end, in order by
> the diversion number (in this case, 3).

Well this is definitely an interesting solution.  The problem is that it
doesn't apply to the loadable policy modules, since the file contexts in
a module don't have m4.  Preserving m4 into the modules, and having
semodule run m4 to reconstruct file_contexts is probably a bad idea.
Adding a weight to specs, which is what Steve suggested, would be more
general than leveraging m4.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.