Re: [RFC] 0/4 - Hierarchal apache policy for reference policy

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

Stephen Smalley wrote:
> On Thu, 2007-01-18 at 13:40 -0500, Karl MacMillan wrote:
>> Joshua Brindle wrote:
>>> Karl MacMillan wrote:
>>>> Joshua Brindle wrote:

<snip>

>>>> I think the biggest hurdle to this gaining widespread use is the 
>>>> length of the meta-policy, especially since it essentially repeats the 
>>>> policy for the sub-types. Any ideas about how to shorten this policy?
>>>>
>>> nit: the meta-policy is short (5 lines). The policy itself is longer due 
>>> to the propagation of rules to children types.
>>>
>> Fine - but that answer the question. Having to define container types 
>> with a superset of the rules results in a much longer policy. I think 
>> that it is going to be hard to convince people to add that policy.
> 
> Policy build could automatically generate the rules for the container
> types from the child type rules, as long as they come from the same
> source (e.g. all part of the base policy build, or all within the same
> module).  Then you only need to explicitly state rules for the container
> types for accesses that you wish to permit to externally defined
> children.
> 

That's probably a good solution. Wouldn't be too hard to make a tool to 
do this from selgen / sepolgen / madison.

Karl

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.