Re: Now that SELinux supports booleans should we replace tunableswith booleans?

[Daniel J Walsh <dwalsh@redhat.com>]

Stephen Smalley wrote:

>On Fri, 2004-08-06 at 12:20, Stephen Smalley wrote:
>  
>
>>Yes, it shouldn't be difficult to create a genpolbools utility similar
>>to the recently created genpolusers utility.  However, I think that Dan
>>would want the functionality available as a library function that
>>operates entirely in-memory rather than on files, so that load_policy
>>can directly invoke it on the mmap'd policy file to rewrite the binary
>>policy in memory based on the separate saved boolean settings prior to
>>loading it into the kernel.
>>    
>>
>
>This has now been implemented in the sourceforge CVS tree; the
>checkpolicy core logic has been moved into a libsepol library, a
>sepol_genbools() function for rewriting a binary policy in memory for
>new boolean definitions has been added to libsepol, and load_policy has
>been changed to use this function prior to reloading the policy.  A
>separate genpolbools utility that performs the same transformation but
>with files as input and output has also been added to the checkpolicy
>tree.
>
>  
>
>>Under the proposed scheme, reboots and policy reloads would set the
>>booleans to the values saved in /etc/selinux/$SELINUXTYPE/booleans
>>(defaulting to the compile-time defaults if there was no value saved in
>>that file for a given boolean).  Admins would edit that file (directly
>>or using a tool) if they wanted the boolean setting to persist; if they
>>only want a temporary change that will be reverted by a reboot or policy
>>reload, then they would use setsebool to make that temporary change.
>>    
>>
>
>Karl has suggested that while /sbin/init should use this technique for
>preserving booleans across reboots, /usr/sbin/load_policy should just
>get the current boolean settings from selinuxfs and use them for policy
>reloads, so that booleans do not change upon a policy reload by
>default.  This is to ensure that booleans that represent system state
>are not perturbed by policy reloads.  What do others think?
>
>  
>
I agree with Karl.  Maybe a switch to load_policy to restore system 
defaults.

Dan


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.