Re: Policy Language

[Russell Coker <russell@coker.com.au>]

On Wed, 8 Jan 2003 19:02, Frank Mayer wrote:
> I would ask that we only change the policy syntax reluctantly and as
> limited as possible, and only for strong need.  Every time the language
> changes, it can be a lot or little work for us to sync up our parser for
> setools.  Since we have a requirement to maintain backwards
> compatibility with older policy syntax, each change can be a lot of
> work.

While we're on the topic, I think it would be good if the following files 
change as little as possible, and wherever possible the only changes should 
be in adding new entries.
access_vectors
initial_sids
security_classes
initial_sid_contexts

Whenever we have a major change to the kernel code it seems to result in a 
situation where the policy and the checkpolicy program need to be updated at 
the same time.  Installing the checkpolicy program first has no drastic 
consequences, but installing the new policy first can screw up an existing 
kernel.

This is something I still haven't adequately addressed in my Debian packages, 
and is probably something that will cause problems for other people who are 
preparing SE Linux packages.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.