Stephen Smalley <sds@xxxxxxxxxxxxx> wrote: > They would correspond with the operations provided by the /dev/cachefiles > interface, at the granularity you want to support distinctions to be made. Can this be made simpler by the fact that /dev/cachefiles has its own unique label (cachefiles_dev_t). > Could just be a single 'setcontext' permission if that is all you want to > control distinctly, or could be a permission per operation. There is only one operation that makes sense to have a permission: "set context and begin caching". All the other operations on a file descriptor attached to /dev/cachfiles are necessary for there to be a managed cache at all, and given that you've managed to open /dev/cachefiles that's sufficient access for those, I think. > If the latter, you don't really need a label for the object, and can > just use the supplied context/secid as the object of the permission > check, ala: > rc = avc_has_perm(tsec->sid, secid, SECCLASS_CACHEFILES, > CACHEFILES__SETCONTEXT); Ummm. I was under the impression that the target SID had to be a member of target class. David -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
