| Main Archive Page > Month Archives > selinux archives |
Re: [patch 0/2] policy capability support
From: Stephen Smalley <sds_at_nospam>Date: Wed Dec 05 2007 - 20:34:04 GMT
To: Joshua Brindle <method@manicmethod.com>
On Wed, 2007-12-05 at 15:16 -0500, Joshua Brindle wrote:
> Stephen Smalley wrote:
> > On Wed, 2007-12-05 at 14:30 -0500, Todd Miller wrote:
> >> Paul Moore wrote:
> >>> The discussion for this appears to have gone quiet (at least I
> >>> haven't seen anything else on this list). Where do things currently
> >>> stand?
> >> At this point I'd be OK with requiring equivalence and throwing an error
> >> otherwise. I do think that this will result in usability issues that we
> >> will have to address once people start using the caps. However, with
> >> only
> >> a single cap defined so far it is not really possible to know how these
> >> will end up being used.
> >
> > We could try to come up with a solution at least for allowing clean
> > upgrades from F8 (w/o any caps) to F9 (likely w/ peer cap defined)
> > without requiring manual user intervention for dealing with local
> > modules.
> >
>
> This was my exact objection to using an intersection or equivalence. IMO
> it is incompatible to require all modules to be the same and to also
> require upgrades to work without manual intervention.
>
> Do you still think unioning is wrong?
Yes, I'm still against (automatic, default) unioning of the capabilities by the linker - that is clearly not a safe default. semodule could possibly override that behavior based on an option though, at which point the %post scriptlet in the policy rpm could use that option if we wanted to force it w/o user intervention.
> > There are however plenty of other ways in which a policy upgrade can
> > break at present.
> >
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.