From: "Christopher J. PeBenito" <cpebenito@tresys.com>
To: Daniel J Walsh <dwalsh@redhat.com>
Cc: Eric Paris <eparis@redhat.com>, <qingtao.cao@windriver.com>,
Eric Paris <eparis@parisplace.org>, <slawrence@tresys.com>,
<selinux@tycho.nsa.gov>
Subject: Re: v0 Separate tunables from booleans
Date: Fri, 26 Aug 2011 09:08:11 -0400 [thread overview]
Message-ID: <4E579ABB.5030808@tresys.com> (raw)
In-Reply-To: <4E579A65.3090002@tresys.com>
On 08/26/11 09:06, Christopher J. PeBenito wrote:
> On 08/26/11 08:59, Daniel J Walsh wrote:
>> I agree, I would like to take the patch to make tunables real, but we
>> need to have a similar level of diagnosis capability to what we have now.
>>
>> The admin needs to know what the tunables are and needs to be able to
>> take an AVC and see if any tunable/boolean would allow the AVC.
>>
>> If we had this, I would be racing towards the tunable.
>>
>> I see this as two steps.
>>
>> 1. Implement what we have now in booleans in tunables to shrink the
>> size of policy.
>> 2. Allow policy writers to define rules within tunables that is
>> currently not available in booleans.
>> - Type Definitions
>> - Assigning attributes
>
> I would go farther than that. I think it should be any statement that
> is allowed in an optional block. If I can get the RBAC stuff in there,
> then I can get rid of the DIRECT_INITRC build option, which exists due
> to the role_transition statement in the init_run_daemon() interface.
By "get rid of" I mean "convert to tunable".
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2011-08-26 13:08 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-23 10:08 v0 Separate tunables from booleans Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 1/6] Indicate when boolean is indeed a tunable Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 2/6] Separate tunable from boolean during compile Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 3/6] Write and read TUNABLE flags in related data structures Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 4/6] Permanently enable the if or else branch of a tunable during link Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 5/6] Copy and check the cond_bool_datum_t.flags " Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 6/6] Skip tunable identifier and cond_node_t in expansion Harry Ciao
2011-08-23 13:43 ` Daniel J Walsh
2011-08-23 13:58 ` Christopher J. PeBenito
2011-08-24 10:32 ` HarryCiao
2011-08-24 12:11 ` Christopher J. PeBenito
2011-08-24 18:00 ` Joshua Brindle
2011-08-25 10:36 ` Harry Ciao
2011-08-24 18:02 ` Joshua Brindle
2011-08-25 3:22 ` Harry Ciao
2011-08-25 4:22 ` Joshua Brindle
2011-08-25 10:38 ` Harry Ciao
2011-08-24 17:54 ` Joshua Brindle
2011-08-24 20:24 ` Daniel J Walsh
2011-08-24 20:34 ` Joshua Brindle
2011-08-24 21:04 ` Daniel J Walsh
2011-08-24 16:02 ` v0 Separate tunables from booleans Eric Paris
2011-08-25 6:17 ` Harry Ciao
2011-08-25 13:04 ` Daniel J Walsh
2011-08-25 13:35 ` James Carter
2011-08-26 14:28 ` Daniel J Walsh
2011-08-26 1:17 ` Harry Ciao
2011-08-26 2:22 ` Eric Paris
2011-08-26 12:59 ` Daniel J Walsh
2011-08-26 13:06 ` Christopher J. PeBenito
2011-08-26 13:08 ` Christopher J. PeBenito [this message]
2011-08-26 14:11 ` Christopher J. PeBenito
2011-08-24 17:38 ` Christopher J. PeBenito
2011-08-24 17:52 ` Joshua Brindle
2011-08-25 5:31 ` Harry Ciao
2011-08-25 12:56 ` Joshua Brindle
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4E579ABB.5030808@tresys.com \
--to=cpebenito@tresys.com \
--cc=dwalsh@redhat.com \
--cc=eparis@parisplace.org \
--cc=eparis@redhat.com \
--cc=qingtao.cao@windriver.com \
--cc=selinux@tycho.nsa.gov \
--cc=slawrence@tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.