idea for reducing policy size: put representation of macros in binary form

[Luke Kenneth Casson Leighton <lkcl@xxxxxxxx>]

mad-cap idea that should NOT be taken to its literal extreme (except
possibly in the case of an embedded system with more time than memory on
its hands).

how about, in trading off against processing power, making a
[possibly limited] means to represent the macros or equivalent
in binary form in the policy?

the reasoning behind this is to reduce the size of the policy, and to
have them expanded out (not using m4 obviously) by the selinux
capability module at runtime.

optionally cacheing the results of course, with the possibility of
throwing these cached results away if too much memory gets used.

certain macros could be an appropriate target but others, macros of
macros etc. would not.  yet.

l.

-- 
--
<a href="http://lkcl.net";>http://lkcl.net</a>
--

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.