Re: Update to docs

[Joshua Brindle <method@manicmethod.com>]

Stephen Smalley wrote:
> On Thu, 2012-09-13 at 16:58 -0700, William Roberts wrote:
>> Can I get the documentation on the wiki updated under "SE Android
>> policy" the second paragraph. I would like to update that you can
>> specify genfs_context files and seapp_context files...maybe something
>> like below will be sufficient:
>>
>> Device-specific additions for the policy configuration can be placed
>> in a sepolicy.te file (for kernel TE policy rules), a sepolicy.fc file
>> (for file_contexts entries), a sepolicy.pc file (for property_contexts
>> entries), a sepolicy.genfs_contexts file (for genfs entries), or
>> seapp_contexts (for seapp rule entries) under any of the
>> target/board/<device>, device/<vendor>/<device>, or
>> vendor/<vendor>/<device>  directories. These files if present are
>> merged into the policy during the build.
>
> Updated.  However, this is starting to get unwieldy.  I was wondering
> whether we should switch over to a model where we permit a sepolicy
> subdirectory under the device directories that can contain any kind of
> policy file (without requiring a sepolicy. prefix on each one since they
> will be in a subdirectory).  Just need to decide how we would merge
> multiple .te files with the same name, i.e. concatenate/union vs.
> replace/override.
>

I'd prefer something like POLICY_FILES += some-policy-file.te.

The reason is that under my maguro directory I now have a full_maguro.mk 
that builds a more-or-less upstream maguro and a tresys_maguro.mk that 
adds stuff we are doing. Right now the policies are all merged because 
there isn't another option but with a POLICY_FILES variable we could 
have custom policy per product.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.