Re: conflict between libselinux and libsepol

[Joshua Brindle <jbrindle@tresys.com>]

Colin Walters wrote:

>On Fri, 2004-08-20 at 15:37 -0400, Colin Walters wrote:
>  
>
>>On Fri, 2004-08-20 at 15:00 -0400, Stephen Smalley wrote:
>>    
>>
>>>On Fri, 2004-08-20 at 11:24, Stephen Smalley wrote:
>>>      
>>>
>>>>Hence, I would recommend that we add a function to libsepol to provide a
>>>>higher level interface for context validation against a given binary
>>>>policy, add it to libsepol.map, and declare the prototype in sepol.h for
>>>>use by setfiles.
>>>>        
>>>>
>>>Patch for libsepol attached, along with a sample program.  I'll add it
>>>to the sourceforge CVS.
>>>      
>>>
>
>And a patch for the policy Makefile to cause it to verify the file
>contexts under the "policy" target.  I think this makes sense because
>conceptually the file contexts is part of the whole system security
>policy.
>  
>
>  
>
How is this the case at all? Conceptually the file contexts is *not* 
part of the system policy, afaik that is a major design feature of 
SELinux, that the enforcement and labeling is totally seperate (with the 
exception of ocontext stuff ofcourse)

I believe this is the case, unless Steve disagrees ofcourse :)

Joshua

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.