Re: policy hierarchy patch

[Darrel Goeddel <dgoeddel@TrustedCS.com>]

Joshua Brindle wrote:
> On Thu, 2005-04-07 at 11:30 -0500, Darrel Goeddel wrote:
> 
>>Stephen Smalley wrote:

>>>The original hierarchy patch also collapsed the identifier and
>>>user_identifier together, thereby allowing "-" to occur in any
>>>identifier.  As a result, if someone specifies s0-s9 in the policy
>>>without whitespace, it will be incorrectly interpreted as an attempt to
>>>specify a level named "s0-s9".  Further, nothing prevents someone from
>>>defining a level or category name that includes a "-" presently.
>>>Options are to revert the change from the original patch that collapsed
>>>identifier and user_identifier together (only adding "." to identifier,
>>>not "-") or to add further handling to the action routines to deal with
>>>it.
>>>
> 
> 
> Out of curiousity, why are sensitivity ranged specified with '-' and
> category ranged specified with '.'?
> 

To ease (or make possible) parsing things like "s0:c1 . c4 - s1:c1 . c4".
If it was "s0:c1 - c4 - s1:c1 - c4", the second '-' is ambiguous.  At least
thats why I think its that way...

> I think this is correct, not just because of the explanation above but
> because this may cause issues with space sensitivity in type sets, ie
> { foo-bar } is the same as { foo -bar } now, but wouldn't be with this
> patch. I'll fix this and send out a patch tomorrow.

Ahhh. I misread the comment earlier - I read it as "go back to IDENTIFIER and
MLS_IDENTIFIER".  I think going back to "USER_IDENTIFIER and IDENTIFIER", and
ditching the '-' in Ithe current DENTIFIER is the way to go.

-- 

Darrel

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.