Re: [RFC PATCH 0/2] Series short description

[Paul Moore <paul.moore@hp.com>]

On Tuesday 25 September 2007 6:28:48 pm James Morris wrote:
> On Tue, 25 Sep 2007, Paul Moore wrote:
> > This patchset has two patches in it which I would like to get some
> > feedback on.  The first patch adds a functionality/compatability version
> > number to the policy so that we can add new functionality to the kernel
> > which would lie dormant until the correct policy was loaded - it is not
> > intended to replace Eric's undefined classes/perms work but to compliment
> > it.
>
> Can you explain the expected usage scenarios for this?

The one example that springs immediately to mind is the two separate checks 
for peer labels (one for NetLabel, one for labeled IPsec) in 
selinux_sock_rcv_skb().  As discussed on the list, we would like to move to a 
single check for the peer label.  Unfortunately, this runs into problems with 
backwards compatibility with people using old policy on new kernels.  The 
idea here was that the kernel would have code for both types of access 
control and depending on the policy loaded it would select which type of 
access control to use.

> We already have versioning of policy, and will have the ability to reject,
> ignore or enforce unknown elements, so why do we need this and how would
> it typically be used?

Eric suggested using the policy version to achieve the same thing; if no one 
objects to using the policy version number for this purpose I'm more than 
happy to use it.

> Should we instead start thinking about versioning each permission & class?
> i.e. create a fully versioned interface

This question nags at me, but I keep ignoring it because I fear that a fully 
versioned avc interface would be overkill in the majority of cases and only 
serve to slow down the access checks.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.