Re: policy under version control

[Russell Coker <russell@coker.com.au>]

On Tue, 2 Dec 2003 06:28, Tom <tom@lemuria.org> wrote:
> It seems that in the long run we won't be able to do with a single
> default policy. We'll need a couple, or a modular approach. Something
> very much like Debian's tasksel or other tools for other distributions
> where you have 5-10 fields you can check what your machine is going to
> be, and the relevant policy is then assembled automatically.

I also see a need for multiple policy distributions, but I don't think that 
they will be close enough to each other to enable them to productively be in 
the same tree.

Some policy files such as core_macros.te can be in all policies, but most of 
the .te files won't.

I think that policies will either be close enough that macros can be used to 
merge them, or different enough that they can't be kept to gether in any way.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.