Re: object class discovery userland

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

Eamon Walsh wrote:
> Christopher J. PeBenito wrote:
>> The object manager will also have to be modified to get the new class
>> and perm values on a policy reload.
>>
> 
> Sigh.  Maybe we _would_ be better off hiding the numeric values from the 
> caller.
> 

Maybe instead of just looking up class and permission values, object 
managers should be able to give libselinux a mapping from strings to 
numbers.

For example, the X server could pass something like

{"xwindow", 1}

at startup time.  Then libselinux would internally convert 1 to the real 
class value for xwindow, keeping track of any changes resulting from 
reloads.

The object managers are all going to have to do something like this 
anyway.  Doing it in the library could improve performance for AVC 
lookups, since the AVC entries could be keyed off the untranslated numbers.


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.