Re: New strategy for enableaudit.

[Joshua Brindle <jbrindle@tresys.com>]

Ivan Gyurdiev wrote:
> 
>> This is only a short term solution until we get boolean support for 
>> dontaudit rules.  But modules could do the same thing.   This
>> gives me the ability to debug problems being covered by dontaudit 
>> rules for now though.
> 
> So what's the planned solution using boolean support?
> There's a number of things that could be done here...
> 
> Are you thinking of the module compiler placing dontaudit rules in a 
> conditional block, based on a shared (base) boolean?
> 
not automatically; the refpolicy should just have all dontaudits under a 
   specific boolean. This will be easier when nested conditionals are 
available.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.