Eamon Walsh wrote:
Joshua Brindle wrote:
Eamon Walsh wrote:
Introduces an enforcing mode override option, so the object manager
can bring up the AVC in permissive mode on an enforcing system, or
vice versa.
This is probably more useful but we actually had something like this
with the userspace security server where you could run the USS in
permissive or enforcing independent of the kernel security server.
Ofcourse this would mean its still a global setting across all access
managers using the USS.
Interesting, I would think that the USS would only serve up "raw"
decisions like the kernel security server does. The permissive
setting is a construct of the AVC layer.
The avc gets the enforcing mode from the security server, in this case
the USS was delivering its own enforcing mode independent of the kss.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
