Re: Patch to cleanup audit handling in policy.

[Daniel J Walsh <dwalsh@redhat.com>]

I agree with Karl here.  I think while these are different types of 
interfaces, they are definitely related to doing auditing.  As a policy 
writer I would look into the logging.if for these interfaces and not 
seeing them would write them by hand, probably badly.  (As we have seen 
by the number of times it was done wrong.)  I would not think to look in 
a random directory labeled support with misc_patterns.te or 
file_patterns.te. 

I think the use of constraints should be increased as a way to "assert" 
the policy writer is doing the right thing.    So removing the 
assertions, because we have other places where we don't use constraints 
is an invalid argument.  Lets define assertions there and stop policy 
writers from doing

allow mydomain_t etc_t:file rw_file_perms

and other clearly security problematic code.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.