Re: generic fallbacks of getpeercon (Re: [redhat-lspp] Labeling an interface)

[KaiGai Kohei <kaigai@kaigai.gr.jp>]

>> One more point is here.
>> How should be handled a connection come from unlabeled network, without any
>> fallbacked context? Two ways are considerable for me. One is that
>> getpeercon() really returns -ENOPROTOOPT, the other is returning an initial
>> context newly defined for this purpose.
> 
> My personal opinion is that the current getpeercon() behavior of 
> returning -ENOPROTOOPT when a peer label is not present is probably the best 
> solution as it allows per-application handling of this particular case.  
> Earlier in the thread Stephen mentioned that Eamon had developed a way to 
> handle this for X using a domain specific fallback label and that approach 
> seems to make the most sense to me.

OK, I agree your opinion.
SE-PostgreSQL also follows Eamon's solution for the final fallbacked context,
to avoid unnecessary confusion.

Thanks,
-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.