Re: [RFC] Context ordering based on MLS dominance.

[Casey Schaufler <casey@schaufler-ca.com>]

Dave Quigley wrote:
> This patch set was original made to help in providing unioned polyinstantiated
> directories for MLS. The method used Unionfs to order the branches from the
> highest to lowest levels so when a process at a certain level listed the
> directory contents it would see all of the polyinstantiated directories as one
> with duplicates exposing the document at the highest level found.
>
>   

How do you address TS/A and TS/B objects with the same name in
the presence of a TS/A,B subject? In B&L neither is "higher"
than the other, they are incomparable, and the subject should
be able to read both. I suppose you could chose and document
secondary criteria, but I shouldn't think that very satisfactory.


> Others have expressed a need for this functionality so the patches have been
> revived. The question is should this be done as a kernel interface or should
> it be done on the on disk policy file using libsepol?
>
> The kernel patch is based off of Linus' current git tree as of 6/10 while the
> libselinux patch is based off of the current svn tree from sourceforge as of
> the same date. The patches went through testing initially when I was working
> on polyinstantiated directories but I haven't tested the new version so give
> them a try and see if they meet your needs.
>
>   

Whichever way you would do it, I don't think you've
got a general solution to the problem.

> Dave
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>
>
>   


-- 

----------------------

Casey Schaufler
casey@schaufler-ca.com
650.906.1780



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.