Re: can_network patch.

[David Caplan <dac@tresys.com>]

Valdis.Kletnieks@vt.edu wrote:
> On Fri, 10 Dec 2004 20:11:07 +0100, Thomas Bleher said:
> 
> 
>>Or add a boolean to control the transition from the userdomain to
>>mozilla. Then we can have a locked down policy for people who just want
>>to securely browse the web. People who want all the bells and whistles
>>can turn the transition off at the cost of higher exposure.
> 
> 
> I could live with that.  However, before long we're in danger of getting lost
> in a maze of tiny little twisty booleans, all different... :)
> 

That is a good reason why the use of booleans and addition of 
conditional policy blocks needs to be considered very carefully. 
Another important reason is that even though a chunk of policy may be 
controlled by a conditional expression, from a pure policy analysis 
point of view, it must be considered that the conditional permissions 
are allowed (i.e., if the rule(s) are in the policy then it is 
_possible_ that they may be enabled).  In a perfect world, if the 
permissions are always going to be disabled for a particular instance 
then they shouldn't be in the policy at all.

That said, this issue was discussed before on the list 
(http://tinyurl.com/596gq) and there are practical accepted reasons for 
using booleans/conditionals as tunable mechanisms in some cases.  I 
would just echo your caution that we don't want to get "lost in a maze 
of tiny little twisty booleans".

David

-- 
__________________________________

David Caplan
dac@tresys.com
Tresys Technology, LLC

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.