Re: rawhide targeted vs. refpolicy rpm

[Ivan Gyurdiev <ivg2@cornell.edu>]

>> One thing I am still not clear about is why we need a labeling prefix 
>> that's not related to a role.. how is targeted using the system role, 
>> and labeling things with the user prefix? Isn't the whole point of the 
>> labeling prefix to prevent that type of thing (cross-role communication).
>>     
>
> Targeted policy has no notion of user roles/domains.  There is
> effectively only one SELinux user identity and role in targeted policy;
> the others are purely for compatibility with strict policy in file
> contexts and application configuration files.  Targeted policy only uses
> TE domains to confine particular processes.
>   
So why don't we label files in targeted as system_home_t, which seems 
more correct and workaround this issue. The only change that seems 
necessary to me is to move the defrole functions from sepol and into 
semanage, since they don't do anything in sepol, and are misleading - 
that would be additive divergence on the semanage side. If the user 
wants to query sepol, and write records into semanage, he/she would have 
to set the default role in addition to the other data.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.