Re: Latest diffs

[Klaus Weidner <klaus@atsec.com>]

On Thu, Sep 21, 2006 at 10:49:32AM -0400, Joshua Brindle wrote:
> I don't think this change should be made to the refpolicy policy without
> a good justification, saying "MLS people want it" isn't good, its
> possible that they are also misusing categories.

A fairly typical usage scenario in government use seems to be to have one
category per country plus several for treaty groups or other groups of
countries (NATO, AXIS_OF_EVIL, or whatever). This alone can exceed the
current 256 categories. Since categories generally aren't reusable (old
data should keep its original category set), you want to have a
significant margin for expansion.

The main reason why this would be painful to do as a local site
modifications is that many users who want a MLS system also want to be
running a Common Criteria LSPP evaluated system, and the evaluated
configuration restrictions generally require running the shipped policy
and not a modified one. Since the change requires completely rebuilding
the policy (as opposed to just adding a module) such a change is unlikely
to be acceptable to them.

-Klaus

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.