Re: Fedora/SE-PostgreSQL

[KaiGai Kohei <kaigai@kaigai.gr.jp>]

Christopher J. PeBenito wrote:
> On Tue, 2007-08-07 at 21:12 -0400, Joshua Brindle wrote:
>> KaiGai Kohei wrote:
>>> The attached patch adds definitions of new classes and permissions,
>>> and MLS/MCS rules.
>>>
>>> Following items are differences from the first patch.
>>>
>>> * add "db_" prefix for each object classes.
>>>   e.g) "table" -> "db_table"
>>> * interfaces in policy/modules/kernel/mls.if are renamed.
>>>   - mls_database_read_up    -> mls_db_read_all_levels
>>>   - mls_database_write_down -> mls_db_write_all_levels
>>>   - mls_database_upgrade    -> mls_db_upgrade
>>>   - mls_database_downgrade  -> mls_db_downgrade
>>> * MLS attributes related to database are renamed
>>>   - mlsdatabaseXXXXX -> mlsdbXXXXX

>> These interface names seem kind of ambiguous, they could mean downgrade
>> the database files on disk or within an selinux aware database server.
>> They also have very low granularity, but I haven't decided if that
>> matters much.
>>
>> It would be nice to have less ambiguous interface names though.
> 
> All of the mls interfaces are coarse, as they make mls exemptions.  If
> it was talking about the files on disk, you would be using the mls file
> downgrade interface.

I don't have any special opinion about its naming scheme.
(It is possible to update the patch again, if necessary.)

Is there any other opinion for the "db_" prefixed new object classes?
I just started to modify SE-PostgreSQL to use these prefixed ones.

-- 
KaiGai Kohei <kaigai@kaigai.gr.jp>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.