Re: [PATCH] selinuxfs to globally disable dontaudit rules

[Joshua Brindle <method@manicmethod.com>]

James Morris wrote:
> On Thu, 9 Aug 2007, Eric Paris wrote:
>
>   
>> Currently to disable dontaudit rules best you can do it to load the
>> enableaudit.pp base policy.  Which still doesn't remove the dontaudit
>> rules from modules.
>>     
>
> Are we sure this can't be done in userspace?  Like, mangle all the 
> existing policy and reload it?
>
>   
I agree, the infrastructure is certainly in place to do it, just add 
something in the sepol_handle that says dontaudits should be discarded, 
then make an interface in libsemanage that uses that and rebuild the policy.

If noone beats me to it I will see if my conclusions about it being 
fairly simple are accurate this weekend :)




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.