Re: seandroid and policy version

[Joshua Brindle <jbrindle@tresys.com>]

Stephen Smalley wrote:
> On Tue, 2012-09-18 at 13:40 -0400, Joshua Brindle wrote:
>> Stephen Smalley wrote:
>>> On Wed, 2012-07-11 at 15:49 -0400, Stephen Smalley wrote:
>> <snip>
>>> So this issue has come up again in the context of implementing device
>>> admin APIs and a sample device admin app.  The device admin API
>>> implementation in the system_server needs to know how to name the file
>>> it creates under /data/system for the kernel policy, but it has no way
>>> to determine the actual policy version of the supplied policy.  So it
>>> doesn't know what suffix to use.  Options:
>>> - Get rid of the version suffix altogether, or at least for the sepolicy
>>> file under /data/system.
>>> - Have the system_server parse the header of the policy image to
>>> determine the policy version, and use that as the suffix.
>>>
>>> Thoughts?
>>>
>> Can the MDM server not provide the device admin API with the correct
>> filename to use? How are you feeding the policy to the API?
>
> At the moment it is being passed directly as a byte array (similar to
> security_load_policy).  Passing by pathname would require that the
> system_server have read/search access to a private file created by the
> device admin app, and passing by open fd would require that the device
> admin app first write the policy image to local storage before passing
> it to the system_server.  So passing it directly seems preferable.
>

I assumed byte array but is the API going to basically be "here's your 
policy blob" and the system_server has to figure out what to do with it? 
I strongly believe that we will outgrow an API like that very quickly. 
MDM vendors want to do some interesting things and always doing it on 
the server side isn't going to be feasible I think (holding >10k SELinux 
policies in order to update them when new 
containers/apps/features/whatever are added is not ideal).


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.