Re: libselinux category patch

[Daniel J Walsh <dwalsh@redhat.com>]

Joshua Brindle wrote:

> Daniel J Walsh wrote:
>
>>     range=context_range_get(con);
>>     if (range) {
>>         if(strcmp(range,"s0") == 0 ) {
>>             context_range_set(con,NULL);
>>         }
>>         else         {
>>             ptr=strrchr(range,':');
>>  
>>
> Why is s0 hardcoded here? s0 should be part of the context to be 
> translated, if you don't want the users to see it whatever tool to 
> edit the mappings should hide it, not libselinux.

This code is not part of libselinux,  it is a library that SELinux calls 
out to that will be specific to the vendor that ships it.
I see this library being different between our version of MCS/MLS and 
other third party versions of MLS, IE one that translates using the 
Mitre Libraries.

MCS version of libtrans.so translates s0->"".

MLS policy can do what ever it wants with this part of the range.


-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.