Re: seandroid and policy version

[Joshua Brindle <jbrindle@tresys.com>]

Stephen Smalley wrote:
> On Wed, 2012-07-11 at 15:49 -0400, Stephen Smalley wrote:
<snip>
> So this issue has come up again in the context of implementing device
> admin APIs and a sample device admin app.  The device admin API
> implementation in the system_server needs to know how to name the file
> it creates under /data/system for the kernel policy, but it has no way
> to determine the actual policy version of the supplied policy.  So it
> doesn't know what suffix to use.  Options:
> - Get rid of the version suffix altogether, or at least for the sepolicy
> file under /data/system.
> - Have the system_server parse the header of the policy image to
> determine the policy version, and use that as the suffix.
>
> Thoughts?
>

Can the MDM server not provide the device admin API with the correct 
filename to use? How are you feeding the policy to the API?

I'm a fan of dropping the extension altogether but I'm just trying to 
understand the issue. I'd hope that the system_server wouldn't directly 
try to parse the image, hopefully at least a library would be used.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.