Re: Now that SELinux supports booleans should we replace tunableswith booleans?

[Russell Coker <russell@coker.com.au>]

On Tue, 10 Aug 2004 06:11, Stephen Smalley <sds@epoch.ncsc.mil> wrote:
> > Under the proposed scheme, reboots and policy reloads would set the
> > booleans to the values saved in /etc/selinux/$SELINUXTYPE/booleans
> > (defaulting to the compile-time defaults if there was no value saved in
> > that file for a given boolean).  Admins would edit that file (directly
> > or using a tool) if they wanted the boolean setting to persist; if they
> > only want a temporary change that will be reverted by a reboot or policy
> > reload, then they would use setsebool to make that temporary change.
>
> Karl has suggested that while /sbin/init should use this technique for
> preserving booleans across reboots, /usr/sbin/load_policy should just
> get the current boolean settings from selinuxfs and use them for policy
> reloads, so that booleans do not change upon a policy reload by
> default.  This is to ensure that booleans that represent system state
> are not perturbed by policy reloads.  What do others think?

Sounds good.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.