Re: Adding alternate root patch to restorecon (setfiles?)

[Thomas Bleher <bleher@informatik.uni-muenchen.de>]

* James Carter <jwcart2@epoch.ncsc.mil> [2004-11-05 22:37]:
> I haven't forgotten about this patch.  I will probably be working on
> merging it Monday, without the restorecon stuff at first.

Yes, that's OK. The restorecon stuff was more a "let's toss this idea
around to see what people say about it". I'm not sure myself if it
should be merged.
 
> The $1_domain_file_type attribute is an interesting idea, although the
> name is rather long.

I guess I'm just bad at naming. Feel free to take a shorter name. :)

Thanks,
Thomas


> This patch came just before I merged Dan's patch that added a
> httpdcontent attribute, so some changes will be needed to this patch.
>    
> On Tue, 2004-10-26 at 10:36, Russell Coker wrote:
> > On Tue, 26 Oct 2004 07:31, Thomas Bleher <bleher@informatik.uni-muenchen.de> 
> > wrote:
> > > OK, what do you guys think about the following patch:
> > > It adds an attribute $1_domain_file_type, so all file types from derived
> > > user domains can be grouped together. It also adds a restorecon_domain()
> > > macro, so users can call restorecon to reset the labels on their files.
> > 
> > I've attached a patch named "tom.diff" which applies after your patch to tweak 
> > a few things.  The new attribute allows a better way of dealing with the 
> > locate policy so I changed it appropriately.  I added some use of 
> > sysadm_domain_file_type.  Some of the types you had given the attribute 
> > $1_domain_file_type seemed inappropriate, this includes the print spool type, 
> > some temporary files, and files under /var/run.
> > 
> > Whether we have the user_restorecon_t domain etc is something that needs more 
> > consideration.  The attached patch named "diff" has the user_domain_file_type 
> > stuff from your patch with my amendments but none of the restorecon changes.  
> > I think that "diff" is worthy of being included in CVS regardless of what we 
> > do with restorecon.
> -- 
> James Carter <jwcart2@epoch.ncsc.mil>
> National Security Agency

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.