Re: Where to specific the handling of unknown kernel classes and perms

[Daniel J Walsh <dwalsh@redhat.com>]

Karl MacMillan wrote:
> On Fri, 2007-05-04 at 11:37 -0400, Daniel J Walsh wrote:
>   
>> Joshua Brindle wrote:
>>     
>>> Stephen Smalley wrote:
>>>       
>
> <snip>
>
>   
>>> Ok, I agree, we can work out how to change it on end systems without 
>>> rebuilding the policy later. This should certainly be a managed 
>>> setting so that we can enforce access control on it and audit if 
>>> necessary.
>>>
>>>       
>
> <snip>
>
>   
>> Is this possible to be a boolean?  Tunable eventually.
>>
>>     
>
> Nope - but it could be an semanage command eventually (which would be
> nice since it would generate audit messages).
>
> Karl
>
>   
Ok my question stunk.  The real question is can we make it easy for the 
user
semanage kernel_deny_unknown=1
Which rebuilds and reloads policy.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.