Re: object class discovery userland

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

Christopher J. PeBenito wrote:
> 3. stop exporting class and perm indexes outside of the libraries.  Then
> the reverse lookup wouldn't be needed.  This would involve some
> overhauling of the libraries.

I don't think this is a good idea because of the disruption it would 
cause with access vector processing (as passed to security_av_string() 
and avc_has_perm()).  How do you or together strings?

Why not just cache the numbers in the library, as Karl suggested, or 
create a parallel "class_num" or "class_index" directory with numeric 
nodes (perhaps renaming class to class_name).

class_num/perms/1
class_num/name


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.