Re: Latest policycoreutils patch

[Ivan Gyurdiev <ivg2@cornell.edu>]

> Policy server avoids the need for the client program to pass DAC checks
> on the module store, but a) some kind of checking will certainly be
> applied by the policy server on client requests, and b) use of policy
> server will not be mandatory at least in the short term (even after it
> is merged).
>   
Is there a problem with making some of those store files world-readable, 
and making changes to allow lock files to be written by ordinary users 
somehow. I don't understand why the selinux copy if the data is 
readable, but the semanage copy is not, if they contain the same thing.
> Also, the current usage pattern for file_contexts and seusers is that
> libselinux reads the installed files for runtime operation rather than
> getting the information from libsemanage, so I'm not sure why chcat -L
> -l wouldn't just read the installed seusers file too (preferably via
> libselinux function).  The installed files already have DAC modes that
> allow user read access, subject only to policy restrictions.
>   
Libsemanage has an interface for that kind of thing already - why can't 
that be used? I'm starting to get confused about the difference between 
all those libraries again. If libselinux is to be used on runtime, and 
libsemanage on persistent policy, then how do you explain the need for 
active booleans backend in libsemanage?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.