MLS + MCS?

[Michael C Thompson <thompsmc@us.ibm.com>]

While writing some policy, I came across a situation that was causing 
the policy I was writing to be constructed in an invalid fashion. What 
was happening was this:

Using an old Makefile, my $(TYPE) was being generated as 
'strict-mls-mcs', which was causing the support template 'gen_context' 
to get completely confused.

The macro is defined thusly:

########################################
#
# gen_context(context,mls_sensitivity,[mcs_categories])
#
define(`gen_context',`$1`'ifdef(`enable_mls',`:$2')`'ifdef(`enable_mcs',`:s0`'ifelse(`$3',,,`:$3')')')dnl

I'm wondering, how does this make sense? I'm unclear as to how having 
both mls_sensitivity and [mcs_catergories] defined in this way has meaning.

Because of having both '-mls' and '-mcs' in my $(TYPE), the invalid 
policy I was compiling ended up looking like this:
user:role:type:$2:s0:$3

It would seem to me that MLS and MCS are mutually exclusive, at least in 
this macro.

Thanks,
Mike


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.