Re: [PATCH 1/2] libselinux: class and permission mapping support

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

Joshua Brindle wrote:
> Eamon Walsh wrote:
>> This provides support for userspace object managers to
>> register a mapping of class and permission values.  After the
>> mapping is registered all libselinux functions that take a
>> security class or permission value must be provided with
>> mapped values instead of the "real," kernel values.
>>
>> Changes from the original interface proposal: No
>> selinux_init() function, just a straight set_mapping()
>> function.  Also, to simplify things the incoming mapping does
>> not include explicit values; the classes and permissions are
>> numbered implicitly by their ordering.  NULL strings are used
>> to terminate the lists.
>>
>> Tested with X server, no problems encountered.
>>
>> This patch includes the interface and implementation of the mapping
>> set function. 
>>
> 
> Hrm, I thought we agreed that remapping access vectors at runtime was a
> bad idea?
> 

I did think that initially, but I didn't realize that the mapping could 
be done underneath the AVC instead of on every single call to 
avc_has_perm or whatnot.

The overhead of the remapping should be negligible compared to the cost 
of an selinuxfs operation, right?  And it frees the userspace object 
manager from having to manage the translation tables itself.


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.