On Wed, 2008-01-09 at 18:56 +0000, David Howells wrote: > Stephen Smalley <sds@xxxxxxxxxxxxx> wrote: > > > Right, the latter is reasonable. > > Requires adding the class and permission definition to > > policy/flask/security_classes and policy/flask/access_vectors and then > > regenerating the kernel headers from those files, ala: > > svn co http://oss.tresys.com/repos/refpolicy/trunk refpolicy > > cd refpolicy/policy/flask > > vi security_classes access_vectors > > <add new class to end> > > make > > make LINUX_D=/path/to/linux-2.6 tokern > > Does this require rebuilding and updating all the SELinux rpms to know about > the new class? Policy ultimately has to be updated in order to start writing allow rules based on the new class/perm. libselinux et al doesn't have to change. If you have a "SELinux: policy loaded with handle_unknown=allow" message in your /var/log/messages, then new classes/perms that are not yet known to the policy will be allowed by default, so the operation will be permitted by the kernel. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
