Re: FCGlob

[ramsdell@mitre.org (John D. Ramsdell)]

"Christopher Ashworth" <cashworth@tresys.com> writes:

> Ack!  Wait!  Danger!  Will Robinson!  :)

I'm laughing.  I watched first runs of that show.  I hope your arms
were flailing as you wrote that text.

> Since in a subsequent email you said "I have no experience
> implementing finite state machines" I assume that what you mean
> above by all the "it is easy" bits is that it is easy in theory.

This is correct.  It could be easy in practice, I just don't know.

> That's why the current file context system uses heuristics instead
> of a real sorting algorithm.

The paper states that an FCGlob prototype would require creating:

   A comparison function that receives two patterns as parameters and
   returns the set relationship. Possible set relationships between
   the set of paths pattern A matches and the set of paths pattern B
   matches are: subset, superset, disjoint and ambiguous.

I speculated that finite automata is required to implement the
comparison function as specified.  Do you have an alternative
algorithm that meets the above specification?  I don't recall seeing
one in the paper.

> But the observation at hand is that replacing regular expressions in
> the file context specs would buy us a lot of improvements.

As I said at the meeting, I like the idea of using file globbing
syntax as I agree with your assertion they are less error prone.

John

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.