Re: [2.6 patch] selinux: possible cleanups

[Christoph Hellwig <hch@infradead.org>]

On Mon, Nov 29, 2004 at 11:08:16AM -0500, Stephen Smalley wrote:
> These functions are part of an overall interface between the AVC and the
> security server designed to support dynamic security policy
> requirements, based on prior studies including some formal analysis. 
> While the example security server does not presently use anything other
> than avc_ss_reset, I'd be hesitant to completely remove the rest of the
> interface, as that will leave a far less functional interface for future
> security servers and may lead to further "optimization" of the AVC that
> will preclude support for dynamic policy requirements (or at least make
> it much harder to restore such support).

Feel free to add it whenever you need it.  So far keeping the kernel
small and allowing for the optimizations you fear seems far more important
than some vapourware.

> >   - ss/services.c: security_member_sid
> 
> There are patches under development for SELinux that make use of this
> function, including exporting the interface to userspace via selinuxfs
> and using it in-kernel for polyinstantiation.

And the ETA for those in mainline is?