Re: [ libsepol 6/6] Summary

[Joshua Brindle <jbrindle@tresys.com>]

Ivan Gyurdiev wrote:

>There is no 6/6.. i started counting at 0.
>Just wanted to mention some things:
>  
>
meh.

>- Note that no new functions are exposed
>via the shared interface, following the plan
>to make this library static.
>
>- Hopefully internal data structures can
>eventually be removed from headers, and
>we can rely on external data structures.
>
>  
>
probably not, there isn't really a need to add a layer of abstraction 
between checkpolicy and libsepol as checkpolicy is very tied to the 
policydb structure.

>- If you have complaints about the API,
>please let me know, and I'll fix it - I
>received no comments on my users patch
>when I posted it last time, so I followed
>the same approach.
>
>- Checkpolicy code should be routed to those new
>functions, and so should libsemanage.
>
>- I haven't put in a scope check (is_id_in_scope),
>which checkpolicy currently does -
>I didn't understand quite how that works. 
>If it is necessary, please let me know.
>
>  
>
Depends on what you are doing. The scope checks to see if symbols being 
refered to are in scope. In the module language there is an optional 
command that has a scope different from the global (symbols required for 
the optional to be activated are added to the active scope).

For purely monolithic policies it won't have an effect but with modules 
it must be done to ensure internal consistency in the policy.

>- manpages still need to be written
>  
>
don't you mean info pages ;)



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.