Re: Policycoreutils latest diffs.

[Daniel J Walsh <dwalsh@redhat.com>]

Ivan Gyurdiev wrote:
>
>>
>> Let's look at two cases of code that I don't understand:
> Here's another one from the user add:
>
>                (rc,exists) = semanage_user_exists_local(self.sh, k)
>                if not exists:
>                        (rc,exists) = semanage_user_exists(self.sh, k)
>                        if not exists:
>                                raise ValueError("SELinux user %s is 
> already defined." % name)
>
> This doesn't make sense, because you take the same action regardless 
> of whether the exist test fails locally, or on the final result (which 
> combines policy with local modifications). Hence, you might as well 
> skip the first one and go straight to the second one (which will 
> include the first one).
>
>
>
>
>
Ok, I might have misunderstood the symantics.  But Should the following 
checks be in place


delete
if does not exist local; error since you can not delete an object from 
the server?
Prevent the user from deleting SELinux User "root"

Add
if does exist: error

Modify:
If does not exist local; you are not allowed to modify, see above.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.