seapp_contexts boolean support

seapp_contexts boolean support

[William Roberts]

[-- Attachment #1: Type: text/plain, Size: 758 bytes --]

I was thinking of adding support to enable seboolean control over
seapp_contexts. We have had to make a weird change to seapp_contexts for
CTS and it would be nice if that only got pulled in and used when the CTS
boolean is enabled.

I was thinking is could work like this:

seapp_contexts would have an additional option, sebool, you could set this
to the name of the seboolean, such as CTS.

When the code that parses the seapp_contexts file
(selinux_android_setcontext) could check the sebool flag first, and if it
matches, apply the existing rules to it, else, throw it away as a possible
match.

Would anyone find this useful, and if so I can code it up tomorrow after I
submit the Settings app patches to Garrett.

-- 
Respectfully,

William C Roberts

[-- Attachment #2: Type: text/html, Size: 913 bytes --]

Re: seapp_contexts boolean support

[Stephen Smalley]

On Wed, 2012-07-18 at 18:28 -0700, William Roberts wrote:
> I was thinking of adding support to enable seboolean control over
> seapp_contexts. We have had to make a weird change to seapp_contexts
> for CTS and it would be nice if that only got pulled in and used when
> the CTS boolean is enabled.
> 
> 
> I was thinking is could work like this:
> 
> 
> seapp_contexts would have an additional option, sebool, you could set
> this to the name of the seboolean, such as CTS.
> 
> 
> When the code that parses the seapp_contexts file
> (selinux_android_setcontext) could check the sebool flag first, and if
> it matches, apply the existing rules to it, else, throw it away as a
> possible match.
> 
> 
> Would anyone find this useful, and if so I can code it
> up tomorrow after I submit the Settings app patches to Garrett.

So you mean adding a new input selector to seapp_contexts so that we can
write entries like this:
sebool=android_cts domain=cts_app levelFromUid=true
and have it only match if android_cts is set to true?

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.