Re: [RFC] Ability to allow unknown class and permissions

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

Stephen Smalley wrote:
> On Mon, 2006-12-04 at 16:05 -0500, Karl MacMillan wrote:
>> Stephen Smalley wrote:
>> See above.
> 
> You still need validation in the kernel, and the policy would still lack
> kernel classes and/or permissions unless libsemanage/libsepol is also
> inserting fake entries for the missing ones, so how would the kernel
> handle missing classes and permissions?  How would it know that
> userspace had already padded the avtab for them?
> 
> I'm unconvinced that this approach is simpler overall compared to direct
> kernel implementation at load time.
> 

You may be right and I don't feel that strongly about it. I was really 
just hoping that the discovery interface would finally get done.

Karl

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.