Attributes in new binary format

[Joshua Brindle <jbrindle@tresys.com>]

In the new binary format the attribute values are preserved in the avtab 
but the attribute entries in the type symbol table are destroyed.

This makes analysis on the binary format difficult for a number of reasons.

Tools like apol will have to expand the type bitmaps and will lose 
attibutes on types. This is the same as analysing the current (v19) 
binary format but including attributes will be beneficial to analysis.

Further, the hierarchal constraint checking is currently broken with the 
new format. The reason is that we must be able to expand attributes at 
check time to ensure that types weren't given permissions via attributes 
that violate the constraints. This can be done with the new format but 
it's very time consuming.

I'd like to suggest that we preserve the attibute entries in the type 
table in the binary format and modify the kernel read function to not 
allocate space for them as it reads them in. This makes the binary 
format much more usable in terms of analysis at no cost to the kernel 
memory.

Let me know what you think.

Joshua

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.