mmac-4.1.1?

mmac-4.1.1?

[Joshua Brindle]

I'm wondering if there are plans for an mmac-4.1.1 branch? I see 
mmac-4.0.4 and mmac (which I assume tracks master). I'd like 
install-time and revocation mmac in 4.1.1. Perhaps I'm missing a branch 
that provides that?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: mmac-4.1.1?

[Stephen Smalley]

On Tue, 2012-09-11 at 10:00 -0400, Joshua Brindle wrote:
> I'm wondering if there are plans for an mmac-4.1.1 branch? I see 
> mmac-4.0.4 and mmac (which I assume tracks master). I'd like 
> install-time and revocation mmac in 4.1.1. Perhaps I'm missing a branch 
> that provides that?

We merged the install-time MAC support into our main seandroid branches
(i.e. seandroid, seandroid-4.0.4, and seandroid-4.1.1) back in July.
Since that time, mmac and mmac-4.0.4 haven't been maintained - they are
dead (and I don't think they even exist on bitbucket).

We did recently create revoke-perms-jb and tagprop-jb branches with
rebased versions of the revoke-perms and tagprop changes.  You should in
theory be able to cherry-pick changes from those branches onto
seandroid-4.1.1.  But we haven't been doing much with them of late.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: mmac-4.1.1?

[Joshua Brindle]

Stephen Smalley wrote:
> On Tue, 2012-09-11 at 10:00 -0400, Joshua Brindle wrote:
>> I'm wondering if there are plans for an mmac-4.1.1 branch? I see
>> mmac-4.0.4 and mmac (which I assume tracks master). I'd like
>> install-time and revocation mmac in 4.1.1. Perhaps I'm missing a branch
>> that provides that?
>
> We merged the install-time MAC support into our main seandroid branches
> (i.e. seandroid, seandroid-4.0.4, and seandroid-4.1.1) back in July.
> Since that time, mmac and mmac-4.0.4 haven't been maintained - they are
> dead (and I don't think they even exist on bitbucket).
>
> We did recently create revoke-perms-jb and tagprop-jb branches with
> rebased versions of the revoke-perms and tagprop changes.  You should in
> theory be able to cherry-pick changes from those branches onto
> seandroid-4.1.1.  But we haven't been doing much with them of late.
>

Okay. Looking at the log of revoke-perms-jb it seems like the only 
commit of interest is this one, is that correct?

commit 5ab263eb610d30528134bb28fee5fd83a0bb98aa
Author: rpcraig <rpcraig@tycho.ncsc.mil>
Date:   Fri Aug 24 06:59:51 2012 -0400

     Add revoke permission ability.

     Functionality is driven by policy file. This is a
     departure from the CyanogenMod-esque way of doing
     revocation. No user involvment.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: mmac-4.1.1?

[Joshua Brindle]

Joshua Brindle wrote:
> Stephen Smalley wrote:
>> On Tue, 2012-09-11 at 10:00 -0400, Joshua Brindle wrote:
>>> I'm wondering if there are plans for an mmac-4.1.1 branch? I see
>>> mmac-4.0.4 and mmac (which I assume tracks master). I'd like
>>> install-time and revocation mmac in 4.1.1. Perhaps I'm missing a branch
>>> that provides that?
>>
>> We merged the install-time MAC support into our main seandroid branches
>> (i.e. seandroid, seandroid-4.0.4, and seandroid-4.1.1) back in July.
>> Since that time, mmac and mmac-4.0.4 haven't been maintained - they are
>> dead (and I don't think they even exist on bitbucket).
>>
>> We did recently create revoke-perms-jb and tagprop-jb branches with
>> rebased versions of the revoke-perms and tagprop changes. You should in
>> theory be able to cherry-pick changes from those branches onto
>> seandroid-4.1.1. But we haven't been doing much with them of late.
>>
>
> Okay. Looking at the log of revoke-perms-jb it seems like the only
> commit of interest is this one, is that correct?
>
> commit 5ab263eb610d30528134bb28fee5fd83a0bb98aa
> Author: rpcraig <rpcraig@tycho.ncsc.mil>
> Date: Fri Aug 24 06:59:51 2012 -0400
>
> Add revoke permission ability.
>
> Functionality is driven by policy file. This is a
> departure from the CyanogenMod-esque way of doing
> revocation. No user involvment.

Silly me, that was framework/base, do you know offhand which other 
projects I should look at?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: mmac-4.1.1?

[Robert Craig]

[-- Attachment #1: Type: text/plain, Size: 1983 bytes --]

The commit you mentioned in your prior email is the only one. We moved away
from allowing users the ability to revoke permissions and thus the changes
only dealt with the PMS.

On Tue, Sep 11, 2012 at 11:24 AM, Joshua Brindle <method@manicmethod.com>wrote:

> Joshua Brindle wrote:
>
>> Stephen Smalley wrote:
>>
>>> On Tue, 2012-09-11 at 10:00 -0400, Joshua Brindle wrote:
>>>
>>>> I'm wondering if there are plans for an mmac-4.1.1 branch? I see
>>>> mmac-4.0.4 and mmac (which I assume tracks master). I'd like
>>>> install-time and revocation mmac in 4.1.1. Perhaps I'm missing a branch
>>>> that provides that?
>>>>
>>>
>>> We merged the install-time MAC support into our main seandroid branches
>>> (i.e. seandroid, seandroid-4.0.4, and seandroid-4.1.1) back in July.
>>> Since that time, mmac and mmac-4.0.4 haven't been maintained - they are
>>> dead (and I don't think they even exist on bitbucket).
>>>
>>> We did recently create revoke-perms-jb and tagprop-jb branches with
>>> rebased versions of the revoke-perms and tagprop changes. You should in
>>> theory be able to cherry-pick changes from those branches onto
>>> seandroid-4.1.1. But we haven't been doing much with them of late.
>>>
>>>
>> Okay. Looking at the log of revoke-perms-jb it seems like the only
>> commit of interest is this one, is that correct?
>>
>> commit 5ab263eb610d30528134bb28fee5fd**83a0bb98aa
>> Author: rpcraig <rpcraig@tycho.ncsc.mil>
>> Date: Fri Aug 24 06:59:51 2012 -0400
>>
>> Add revoke permission ability.
>>
>> Functionality is driven by policy file. This is a
>> departure from the CyanogenMod-esque way of doing
>> revocation. No user involvment.
>>
>
> Silly me, that was framework/base, do you know offhand which other
> projects I should look at?
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.govwith
> the words "unsubscribe selinux" without quotes as the message.
>

[-- Attachment #2: Type: text/html, Size: 2879 bytes --]