Re: Refactor Netlink connector?

[jamal <hadi@cyberus.ca>]

On Sun, 2006-28-05 at 23:36 -0700, David Miller wrote:
[..]
> 
> More to the point I think that none of this will be handled
> transparently unless the onus is put on new netlink module users.
> Ie. make the register of a netlink subsystem user (either direct
> netlink or via generic netlink) fail if the operations don't
> provide the SELinux handlers.
>
> Otherwise, the SELinux folks will continually be playing catchup
> writing the handlers.  That doesn't scale.

The scaling problem may be more related to SELinux trying to have
ultimate knowledge of all the subsystems classification. It breaks when
it is something that is not simple as a type (as in this case).

If SELinux should provide ways to add "filters" more dynamically at its
hooks - instead of having people go and look for that table and update
it then it would simplify things and we may be able to easily have
netlink users to register such filters at startup; infact we may be able
to hide this from the users in genetlink. 
One could argue that if SELinux is capable of adding such filters at its
hooks, then the problem could be moved to user space policy perhaps? 

cheers,
jamal