wish-list item for selinux policy analyss

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

dear selinux people,

on my wish-list for selinux is a means to tell, at runtime,
which avc messages have been utilised.  not when - if.

the equivalent of code coverage analysis tools.

i envisage this to be implemented - hand-waving - by a single
bit which is marked in the in-kernel-memory store of selinux avc
policy, for reasons of minimising impact on run-time performance
(i believe that tying something into the avc audit logging
system, would be too slow).

the reason for this is to be able to fire up a system, run
it for a while (live) say oh a few months, and then determine
which bits of the selinux policy.conf have never ever actually
been used.

track them down, and remove them from the selinux source policy.

... via analysis of the policy.conf, back to the macros from
whence they came.

l.

-- 
--
<a href="http://lkcl.net">http://lkcl.net</a>
--

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.