On Thu, 27 Sep 2007 15:53:38 -0400 Karl MacMillan <kmacmill@xxxxxxxxxx> wrote: > 3) Have rpm set contexts that aren't yet valid. This option was > explored and there was even a kernel patch that would allow this. The > fear is that it would allow a malicious package to create files with > _any_ context that is not yet valid. It makes it difficult or > impossible to constrain rpm. You could go back after the policy is > installed and check for contexts that are still invalid and fix > those. No decision was reached about how to handle the hole and > nothing happened. The SELinux upstream developers (well, at least me) > are willing to reconsider this proposal. Wouldn't it be reasonable to lay them down as 'undefined_t' and let the post-rpm transactions relabel them? -- Jesse Keating Fedora -- All my bits are free, are yours?
Attachment:
signature.asc
Description: PGP signature
-- fedora-devel-list mailing list fedora-devel-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-devel-list
