Re: rawhide targeted vs. refpolicy rpm

[Ivan Gyurdiev <ivg2@cornell.edu>]

>
>> Ok, so perhaps what we need is a new semanage policy component that
>> provides libsemanage with:
>> a) default role (or use default_contexts to determine), and
>> b) home directory type prefix for that role, which can be different from
>> the role prefix itself.
>>
>> And then have libsemanage export an interface to genhomedircon to obtain
>> the home directory type prefix for use in generating the file contexts
>> rather than using the role prefix itself.
>>     
>
> Is there agreement on this direction?  Is anyone working on this issue
> yet?
>   

I am very confused..

1. The reason we designate a role as a "default" role is to get the 
labeling prefix. If we already have the labeling prefix, why do we still 
want to keep a "default" role around?

2. The labeling prefix has so far been tied to the user (map is 
seuser->user->(fixed) role -> labeing prefix). Now you're saying the 
login context should play a role in determining the labeling prefix? How 
would this work? Which login context from default_contexts should be used?

3. Is there documentation on default_contexts, and how to work with it?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.