Re: [SEPOL] Remove defrole from sepol

[Joshua Brindle <jbrindle@tresys.com>]

Ivan Gyurdiev wrote:
>>
>>>
>>> Readers should be inside the transaction to guard against race 
>>> condition. You mentioned commit numbers, and I pointed out I don't 
>>> use them yet - and I don't see how they're a win over using a 
>>> transaction.
>>>
>> Copying the whole store to read a boolean is pretty bad. If the user 
>> (app) intends to make a modification they can start a transaction 
>> before  querying, to ensure consistency but a standard reader should 
>> not need to do this. Why copy a whole directory over to do 2 queries 
>> when genhomedircon can just compare 2 numbers?
> 
> 
> ..because then it has to deal with the failure case of when the two 
> numbers are different. I guess in the general case, maybe the reader 
> doesn't want to handle the failure case, so it makes sense to add commit 
> numbers.
> 
> 
Either way you have to handle failure to obtain the lock. Transaction
locks are more likely to be held longer since they are given up
discretionally, whereas query locks are only held for the duration of
that query.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.