From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: <4E9EED35.8070408@manicmethod.com> Date: Wed, 19 Oct 2011 11:31:01 -0400 From: Joshua Brindle MIME-Version: 1.0 To: "Christopher J. PeBenito" CC: Daniel J Walsh , Stephen Smalley , David Windsor , SELinux Subject: Re: I would like to change the behavior of MCS label creations in directory. References: <4E7B9233.6080609@redhat.com> <1316723465.2354.6.camel@moss-pluto> <4E7B9B43.9000400@redhat.com> <1316723821.2354.9.camel@moss-pluto> <1316724121.2354.12.camel@moss-pluto> <4E7C9F3D.9030704@redhat.com> <1316790421.10259.70.camel@moss-pluto> <1317139611.22218.9.camel@moss-pluto> <4E82123C.4070406@redhat.com> <4E985BFB.1000806@redhat.com> <4E9D7267.9060004@tresys.com> In-Reply-To: <4E9D7267.9060004@tresys.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov Christopher J. PeBenito wrote: > On 10/14/11 11:57, Daniel J Walsh wrote: >> Eric and I have come up with the following syntax for this behaviour. >> >> default_trans level dir_file_class_set parent; > > I think we want this to be "range" instead of "level", since the field is actually a range. > >> default_trans user dir_file_class_set process; >> default_trans role file parent; > > Isn't there a better set of tokens than this? Why not make it default_user, default_role, default_type, and default_range? Creating an object doesn't really imply a transition, so "trans" seems misleading. > I agree with Chris. This will actually let you make things not transition by default so _trans is misleading. Further, "process" shouldn't be a token since it is an object class (you couldn't actually parse policy with Eric's patches could you?). I don't like "parent" as a token either, and SELinux doesn't know anything about processes and parents anyway. SDS's suggestions a while back are more appropriate IMO, since SELinux does know what source and target are. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.