All of lore.kernel.org
 help / color / mirror / Atom feed
From: Joshua Brindle <method@manicmethod.com>
To: Daniel J Walsh <dwalsh@redhat.com>
Cc: Harry Ciao <qingtao.cao@windriver.com>,
	cpebenito@tresys.com, slawrence@tresys.com,
	selinux@tycho.nsa.gov
Subject: Re: [v0 PATCH 6/6] Skip tunable identifier and cond_node_t in expansion.
Date: Wed, 24 Aug 2011 16:34:57 -0400	[thread overview]
Message-ID: <4E556071.2030009@manicmethod.com> (raw)
In-Reply-To: <4E555E0F.7000200@redhat.com>

Daniel J Walsh wrote:
>>>
>>>
>>> If we can not duplicate this functionality then I NAK the change
>>> from booleans to tunables.
>> You could actually force a downgrade to a pre-tunable format and
>> use that policy to do the setroubleshoot lookups. Since the policy
>> is already linked/expanded and just needs to be written out twice
>> it wouldn't add much time to policy building (granted that adding
>> _any_ time to policy building is adding too much...)
> I might not have explained it correctly, I really meant the policy
> would have to toggle each tunable/boolean at a time and see if the AVC
> was allowed.  Recompiling the policy for each tunable/boolean change
> would be not be supportable for Time and CPU reasons.
>

What I mean is, if you set the policy writer to not use tunables (by whatever 
method that is) it'll write them out as regular booleans and setroubleshoot 
could load that policy (which should be the same as the loaded one, except with 
extra rules and booleans), toggle the booleans like it does now and do access 
vector lookups to see if a boolean would enable one. Same method as now, there 
would just be 2 policies on disk. Call the one with everything the "debug" policy :)

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

  reply	other threads:[~2011-08-24 20:37 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-08-23 10:08 v0 Separate tunables from booleans Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 1/6] Indicate when boolean is indeed a tunable Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 2/6] Separate tunable from boolean during compile Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 3/6] Write and read TUNABLE flags in related data structures Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 4/6] Permanently enable the if or else branch of a tunable during link Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 5/6] Copy and check the cond_bool_datum_t.flags " Harry Ciao
2011-08-23 10:08 ` [v0 PATCH 6/6] Skip tunable identifier and cond_node_t in expansion Harry Ciao
2011-08-23 13:43   ` Daniel J Walsh
2011-08-23 13:58     ` Christopher J. PeBenito
2011-08-24 10:32       ` HarryCiao
2011-08-24 12:11         ` Christopher J. PeBenito
2011-08-24 18:00         ` Joshua Brindle
2011-08-25 10:36           ` Harry Ciao
2011-08-24 18:02         ` Joshua Brindle
2011-08-25  3:22           ` Harry Ciao
2011-08-25  4:22             ` Joshua Brindle
2011-08-25 10:38               ` Harry Ciao
2011-08-24 17:54     ` Joshua Brindle
2011-08-24 20:24       ` Daniel J Walsh
2011-08-24 20:34         ` Joshua Brindle [this message]
2011-08-24 21:04           ` Daniel J Walsh
2011-08-24 16:02 ` v0 Separate tunables from booleans Eric Paris
2011-08-25  6:17   ` Harry Ciao
2011-08-25 13:04     ` Daniel J Walsh
2011-08-25 13:35       ` James Carter
2011-08-26 14:28         ` Daniel J Walsh
2011-08-26  1:17       ` Harry Ciao
2011-08-26  2:22         ` Eric Paris
2011-08-26 12:59           ` Daniel J Walsh
2011-08-26 13:06             ` Christopher J. PeBenito
2011-08-26 13:08               ` Christopher J. PeBenito
2011-08-26 14:11           ` Christopher J. PeBenito
2011-08-24 17:38 ` Christopher J. PeBenito
2011-08-24 17:52   ` Joshua Brindle
2011-08-25  5:31     ` Harry Ciao
2011-08-25 12:56       ` Joshua Brindle

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4E556071.2030009@manicmethod.com \
    --to=method@manicmethod.com \
    --cc=cpebenito@tresys.com \
    --cc=dwalsh@redhat.com \
    --cc=qingtao.cao@windriver.com \
    --cc=selinux@tycho.nsa.gov \
    --cc=slawrence@tresys.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.