Re: directory polyinstantiation failure

[Ted X Toth <txtoth@gmail.com>]

Russell Coker wrote:
> On Thursday 19 April 2007 02:59, "Xavier Toth" <txtoth@gmail.com> wrote:
>   
>> Why if getexeccon fails doesn't it make sense to polyinstantiate based
>> on context/level? Why not call getcon lf getexeccon fails and use that
>> context instead of switching the method?
>>     
>
> That depends on the aim of the PI.
>
> If the aim is merely to isolate the session from other sessions then it's 
> probably OK to skip the things that don't change (although this optimisation 
> doesn't seem to give any benefit).
>
> If the aim is to give each session a PI directory that matches it's context 
> such that any other session which is established with the same context will 
> have the same directory then all items have to be used.
>
> Also while on the topic, we need an option to do PI based on the GID as well 
> (this was requested on a few occasions when I gave talks about it).  So we 
> could have configuration options to specify a list of items to use, the full 
> SE Linux context, the MLS/MCS level, the role, the Linux UID, and the Linux 
> GID.
>
>   
One of the enhancements I've thinking about would be to allow for a user 
defined method for naming instead of the fixed naming of the current 
implementation. There could be expandable terms like USER, CONTEXT, 
LEVEL, UID, GID, HASH, ROLE which could be used to format the name to be 
generated. For example :
/tmp/foo    /tmp/foo.inst     $LEVEL_$USER   root


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.