Re: semanage non MLS breakage

[Joshua Brindle <jbrindle@tresys.com>]

Ivan Gyurdiev wrote:
>
>>
>> What I don't like about this is that libsemanage skips the MLS check 
>> now, but still proceeds to write any MLS range found to disk. It 
>> should invalidate an MLS range if it sees one. Will submit another 
>> patch on top of the previous one...
> Hmm, I don't know what to do about this...
> There's several options:
>
> 1) Treat this as fatal error. This is by far the simplest solution - 
> we already know when it happens, just make it fatal. Commit is 
> aborted, and there's no problem. It seems a bit.... ugly, however, to 
> abort a commit for which we clearly have all the data, and the user 
> simply has extra data like MLS attached. Nevertheless, considering the 
> options below, I think this is probably the best solution.
>
It's an invalid context, I don't think there is anything you *can* do 
except fatally error. Consider what would happen if there was a proper 
MLS context with multiple levels on an MCS policy...

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.