Re: [RFC] Upstream policy handling

[Daniel J Walsh <dwalsh@redhat.com>]

Colin Walters wrote:

>On Mon, 2004-09-20 at 08:56 -0400, Christopher J. PeBenito wrote:
>
>  
>
>>And my response was that it was not a clean way to do it imo.  I think
>>sysadmfile is an overused attribute.  You're suggesting adding another
>>attribute to fix an attribute problem.  The way I did it was to reduce
>>the sysadmfile types, and then add a tunable that gives back full access
>>if needed by using { file_type -shadow_t }, which is basically what
>>sysadmfile is currently.  If there are other references to sysadmfile,
>>they can also be replaced with the above set.  I don't see how this is
>>less mergeable.
>>    
>>
>
>I'd need to see your patch, but if sysadmfile is really as close to
>{ file_type -shadow_t } as you say, then that sounds fine too.
>
>  
>
With russells latest patches sysadmfile is the same as file_type 
-shadow_t , so we should be able to have a
tunable to restrict sysadm_r access to sysadmfile.


>
>--
>This message was distributed to subscribers of the selinux mailing list.
>If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
>the words "unsubscribe selinux" without quotes as the message.
>  
>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.