Re: Another place where policy blows up because of translations in MCS.

[Darrel Goeddel <dgoeddel@TrustedCS.com>]

Stephen Smalley wrote:
> On Wed, 2005-08-31 at 10:08 -0400, Stephen Smalley wrote:
> 
>>Note that we wouldn't want to require setfiles to link against
>>libsetrans, as there is no upstream libsetrans and it is optional.
>>Hence, either setfiles would need to dlopen libsetrans in the same
>>manner as libselinux to access the translation functions or libselinux
>>needs to export wrapper functions for the translation functions it has
>>already looked up from libsetrans.  The latter seems simpler, but
>>requires that we add such functions to libselinux that are exported and
>>have proper namespace prefixes, unlike the hidden
>>trans_to_raw_context/raw_to_trans_context functions.  The exported
>>functions would also need to internally check the context_translations
>>flag unlike the current trans_to_raw_context/raw_to_trans_context
>>functions.
> 
> 
> See the attached patches for libselinux and setfiles.  Does this address
> the issue?  Is it the right approach (i.e. keeping libsepol
> translation-unaware and handling this in setfiles)?

This seems to be the proper approach.  We should keep the concept of
translated contexts at the higher levels (libselinux and applications) to
keep things as simple as possible.  The patches look good from here.  I
just wonder how I've never seen the problem.

-- 

Darrel

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.