Re: Multiple contexts

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Wed, Jan 12, 2005 at 01:03:02PM -0500, Stephen Smalley wrote:
> On Wed, 2005-01-12 at 13:18, Luke Kenneth Casson Leighton wrote:
> >  sorry.
> > 
> >  something simple:
> > 
> >  i am thinking along the lines of more than one file context being
> >  associated with a file - that sort of thing.
> > 
> >  and permission being checked and allowed on either of the contexts.
> 
> I already explained why you don't want that - it puts the policy into
> the filesystem state.

 there is of course the other scheme which achieves the same end-result,
 but using customised m4 macro-based programs to do it: this scheme
 has been raised before.

 namely, to have your apache.fc file and your customthing.fc file,
 and to "spew forth" a combined apache_customthing_filetype_t with
 some macro preprocessing.

 then your apache.fc is unmodified, it's clean, it can be verified,
 upgraded etc...

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.