Re: [PATCH] libselinux: introduce enforcing mode override option

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

Joshua Brindle wrote:
> Eamon Walsh wrote:
>> Introduces an enforcing mode override option, so the object manager
>> can bring up the AVC in permissive mode on an enforcing system, or
>> vice versa.
>>
> 
> This is probably more useful but we actually had something like this 
> with the userspace security server where you could run the USS in 
> permissive or enforcing independent of the kernel security server. 
> Ofcourse this would mean its still a global setting across all access 
> managers using the USS.
> 

Interesting, I would think that the USS would only serve up "raw" 
decisions like the kernel security server does.  The permissive setting 
is a construct of the AVC layer.


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.