I would like to propose dropping the disable_trans boolean.

I would like to propose dropping the disable_trans boolean.

[Daniel J Walsh]

Several reasons for this.

1.  We have gotten the policy to such a state where most stuff just works.
2.  Problems are easily worked around using audit2allow and loadable 
policy modules
grep badtype /var/log/audit/audit.log | audit2allow -m myfix
3.  Disabling trans often causes more problems then it is worth, because 
of screwed up file context.
4.  You can get the same behavior by changing the file context of a file 
to bin_t.

Thoughts?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: I would like to propose dropping the disable_trans boolean.

[Christopher J. PeBenito]

On Thu, 2007-03-08 at 17:14 -0500, Daniel J Walsh wrote:
> Several reasons for this.
> 
> 1.  We have gotten the policy to such a state where most stuff just works.
> 2.  Problems are easily worked around using audit2allow and loadable 
> policy modules
> grep badtype /var/log/audit/audit.log | audit2allow -m myfix
> 3.  Disabling trans often causes more problems then it is worth, because 
> of screwed up file context.
> 4.  You can get the same behavior by changing the file context of a file 
> to bin_t.
> 
> Thoughts?

I agree with this.  When we get tunables support, a better way can be
added (make the domain unconfined), and then the #3 problem will go
away.  We can't do the unconfining trick with booleans, since the
unconfining requires attributes, which won't work in conditionals.  I
know some people who will be happy to see the removal of m4 hacks I had
to add to make disable trans to work.  Does anyone have reasons too keep
these booleans?

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.