Re: MLS + MCS?

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Thu, 2006-11-02 at 09:48 -0600, Michael C Thompson wrote:
> While writing some policy, I came across a situation that was causing 
> the policy I was writing to be constructed in an invalid fashion. What 
> was happening was this:
> 
> Using an old Makefile, my $(TYPE) was being generated as 
> 'strict-mls-mcs', which was causing the support template 'gen_context' 
> to get completely confused.
> 
> The macro is defined thusly:
[cut]
> I'm wondering, how does this make sense? I'm unclear as to how having 
> both mls_sensitivity and [mcs_catergories] defined in this way has meaning.
> 
> Because of having both '-mls' and '-mcs' in my $(TYPE), the invalid 
> policy I was compiling ended up looking like this:
> user:role:type:$2:s0:$3
> 
> It would seem to me that MLS and MCS are mutually exclusive, at least in 
> this macro.

Yes, they are mutually exclusive.  Sounds like the Makefile that redhat
has is making a mistake on setting TYPE; it has to figure out more than
the upstream refpolicy Makefiles need to because of the
redhat /usr/share/selinux/*/devel setup.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.