RE: file contexts and modularity

[Ivan Gyurdiev <ivg2@xxxxxxxxxxx>]

> An alternative option is to leave the home directory keywords unexpanded and
> have matchpatchcon expand them on demand. This requires knowledge of what is a
> home directory, which is difficult to get. We can either store that information
> somewhere or require the caller to provide, e.g., setfiles could get a flag that
> to allow the admin to specify which directories are home directories.

I disagree that expansions necessarily have to relate to home
directories, and I think it's difficult to predict how expansions will
work in the future. It's hard to come up with a concrete example - this
really depends on what we choose to do with policy in the future.
The point is that we are moving complex logic into a low-level program
such as matchpathcon...and I'm not sure we should do that. It's
a layering issue - where should complexity be placed.

> Anyone else have some insight? It really files like we are over-engineering this
> problem and there is some simple solution once we fully understand the problem.
> I have the gut feeling that pre-expanded file_contexts is the wrong way to go,
> but no clear argument as to why. 

You have a point that we're storing mostly redundant information, but
that's often necessary to achieve speed and simplicity - isn't that
exactly the problem with the in-kernel policy?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.