Re: Question about integration of IPsec with SELinux?

[bsniffen@mitre.org (Brian T. Sniffen)]

Casey Schaufler <casey@schaufler-ca.com> writes:

> Username mapping errors are bad, but one or the
> other of the individuals involved usually detects
> the problem quickly enough. I don't know that I'd
> expect the same to be true of policy elements.

We already see admins doing this regularly: they drop a file from Red
Hat's strict policy into the their Fedora system using Targeted
policy, or from Fedora onto a Debian system, and are surprised when it
does not work.

The average userbase will always expect user_t and httpd_t to mean the
same things everywhere, even though they will not.  It's because of
this difficulty that polgen does only structural analysis, ignoring
accidents of naming.  We're having enough trouble adapting our output
to the evolving details of policy differences (e.g., unconfined_t vs. user_t).

-Brian


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.