Re: [ANN] SE-PostgreSQL 8.2.3-1.0 alpha release

[KaiGai Kohei <kaigai@kaigai.gr.jp>]

Stephen Smalley wrote:
> On Thu, 2007-03-08 at 11:24 -0500, Eamon Walsh wrote:
>> Stephen Smalley wrote:
>>
>>> There are already string_to_security_class() and string_to_av_perm()
>>> functions provided by libselinux, although they should likely have
>>> properly namespaced versions (selinux_ prefix).
>> If we're talking about the API in this area: I had a request for 
>> security_class_to_string and av_perm_to_string functions, I believe from 
>> KaiGai.  The patch in the below e-mail adds them; this could be applied 
>> as an independent patch.
>>
>> http://marc.theaimsgroup.com/?l=selinux&m=116486019626891&w=2
> 
> Ok, so we could:
> - introduce new versions of the existing string_to_* functions with a
> security_ or selinux_ prefix for namespace cleanliness,
> - merge that patch, using the same convention for naming (either as is
> with security_ or replacing with selinux_,
> - have KaiGai rewrite his code to use these functions to map class and
> permission strings to policy values during startup of SEPostgreSQL,
> generating lookup tables for later use by the actual permission checks
> (where the lookup tables would map internal indices private to
> SEPostgreSQL to the policy-defined values obtained from libselinux).
> The tables would need to be revalidated and potentially refreshed upon a
> policy reload, which could be done from an AVC callback.
> 
> Then SEPostgreSQL no longer needs to be compile-time bound to specific
> policy values for its classes and permissions.

I also think it's an excellent idea!
I'll rewrite a part of implementation to generate classes/access vectors
lookup table and to use them.


> Same could be done for XSELinux, right?
> 
> Then when we have the dynamic discovery mechanism implemented, it can
> just be used by those libselinux functions internally, with no further
> change to the object managers.
-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.