Re: object class discovery userland

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

Stephen Smalley wrote:
> On Fri, 2007-05-25 at 17:10 -0400, Eamon Walsh wrote:
>> Here's a first go at an interface.  It's an init function that is a
>> replacement for avc_init().  It takes flags, the class/permission
>> mapping to use, and callback functions.
>>
>> This is trying to solve a few other problems at the same time, namely:
>>
>> - selinux prefix on the function name
>> - drops support for memory, threading, and locking callbacks (would just
>> always use malloc and pthread)
>> - adds type code to logging callback
> 
> As you seem to be making this a generic init function, shouldn't it also
> handle the matchpathcon flags and init support as well?  
> 

I have taken this into account wrt the labeling interface that I have 
been working on that would replace matchpathcon and friends.

Specifically, the patchset would add label flags ("SELINUX_LABEL", 
"SELINUX_VALIDATE", etc.) and a validation/canonicalization callback to 
the arguments to selinux_init(); the labeling interface is handle-based 
so there would be a separate create() function that would take the 
backend to open.


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.