Re: The sort algorithm is broken by the second rule, We need a way to pin these rules to the top.

[Ivan Gyurdiev <ivg2@cornell.edu>]

Joshua Brindle wrote:
> Stephen Smalley wrote:
>> On Fri, 2006-03-31 at 14:18 -0500, Joshua Brindle wrote:
>>> I think libsemanage should just put the .local file out for 
>>> libselinux to read. There is no guarantee that none of the entries 
>>> on .local won't be preceded by something in the normal file context 
>>> if it is merged in libsemanage.
>>
>> Last matching entry takes precedence, so as long as they are merged to
>> the end of file_contexts (as they presently are), the local entries will
>> always take precedence over any earlier matching entry.
>>
> If a user adds a file context entry with a regex operator to .local it 
> will get overridden by a specific match in the policy, I think this 
> would be unexpected to the end user.
So, why does sorting occur at build time, and then additional sorting of 
specific entries occurs at "runtime"?



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.