Re: [PATCH] libselinux: introduce enforcing mode override option

[Joshua Brindle <method@manicmethod.com>]

Eamon Walsh wrote:
> Joshua Brindle wrote:
>> Eamon Walsh wrote:
>>> Introduces an enforcing mode override option, so the object manager
>>> can bring up the AVC in permissive mode on an enforcing system, or
>>> vice versa.
>>>
>>
>> This is probably more useful but we actually had something like this 
>> with the userspace security server where you could run the USS in 
>> permissive or enforcing independent of the kernel security server. 
>> Ofcourse this would mean its still a global setting across all access 
>> managers using the USS.
>>
>
> Interesting, I would think that the USS would only serve up "raw" 
> decisions like the kernel security server does.  The permissive 
> setting is a construct of the AVC layer.

The avc gets the enforcing mode from the security server, in this case 
the USS was delivering its own enforcing mode independent of the kss.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.