We all know we need a better mechanism for handling "binary" policy in the future. ( I think the future is now.)
I see three people providing policy.
1. OS Provider with base policy. (It would also be nice if the base policy got broken into several policies and only the policy
of the running service would be loaded. If we got to this state we would need a new mechanism for restoring file context since
file_context might not meet the currently loaded policy.
2. Third Party application developers. As the use of targeted policy has begun to take off, Third Party ISV have started to question
how they can play in this world.
I see Tresys Stuff solving the problems of both of the above.
3 Local User customization and minor policies. Currently we have people using audit2allow creating files in domains/misc and then
reloading policy. We need a mechanism for users to be able to do this without recompiling policy. Also more significantly how
do we handle the small diffed apache_domain stuff. A couple of months ago I redesigned apache policy to have a macro called
apache_domain. A user could create a new apache_XYZ.te file with
apache_domain(XYZ)
Followed by a few allow rules and be able to get their cgi scripts working without turning off apache protection or running their script in
httpd_unconfined_script_t.
The problem is the only way to do this is to install policy sources and muck around. I think we to have some shared library mechanism
where a few well known macros could be defined and users could easily build their own custom policy.
Anyways I think we need more discussion on handling third party and user customization of policy outside of the current make tree stuff.
Dan
Dan
--
-- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-selinux-list
