Re: [PATCH 0/6] netfilter integration

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

On Wednesday 26 July 2006 10:23, Christopher J. PeBenito wrote:

<snip>

> So after further discussion internally, we were thinking that there
> likely not going to be intermodule dependencies.  Oracle netfilter
> contexts aren't going to conflict with apache's.  Modules are going to
> want to override the contexts in the base module.
>
> So we were thinking that we should do something similar to how other
> parts of the policy are manged, with having base rules, module rules,
> local rules, pre, and post rules.  The pre and post rules would be
> special rules that have to come at the beginning or end of the
> netfilter_contexts file (see the 1's and 9's in my original 0/6 email).
> Then base would be low priority, module would be middle priority, and
> local would be high priority.  Modules that are packaged with an app
> should have the module priority.  The local priority would allow users
> to use the infrastructure to create packages for their own use, for
> example, for applying the rules to a network of machines (manually or
> policy server in the future), which would be more convenient then
> applying rules to iptables by hand on all the machines.

This sounds much better to me.

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.