Re: I would like to change the behavior of MCS label creations in directory.

[Stephen Smalley <sds@tycho.nsa.gov>]

On Wed, 2011-10-19 at 11:31 -0400, Joshua Brindle wrote:
> Christopher J. PeBenito wrote:
> > On 10/14/11 11:57, Daniel J Walsh wrote:
> >> Eric and I have come up with the following syntax for this behaviour.
> >>
> >> default_trans level dir_file_class_set parent;
> >
> > I think we want this to be "range" instead of "level", since the field is actually a range.
> >
> >> default_trans user dir_file_class_set process;
> >> default_trans role file parent;
> >
> > Isn't there a better set of tokens than this?  Why not make it default_user, default_role, default_type, and default_range?  Creating an object doesn't really imply a transition, so "trans" seems misleading.
> >
> 
> I agree with Chris. This will actually let you make things not transition by 
> default so _trans is misleading. Further, "process" shouldn't be a token since 
> it is an object class (you couldn't actually parse policy with Eric's patches 
> could you?). I don't like "parent" as a token either, and SELinux doesn't know 
> anything about processes and parents anyway. SDS's suggestions a while back are 
> more appropriate IMO, since SELinux does know what source and target are.

Unsurprisingly I agree with my original suggestions.  Also, I don't see
that you've addressed the issue of range/level defaults needing to
specify whether you want to inherit the low level, the high level or the
complete range of the source or the target contexts.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.