Christopher J. PeBenito wrote: > I don't like the magic attributes as permissive is a mechanism option. > It has no meaning in the policy, only in the enforcement. I'd really > prefer some other option in selinuxfs or a proc/pid/attr, but since > that doesn't seem to be an option, I'd rather have a policy primitive. To my mind the important thing to decide is whether permissive domains should be persistent in the policy or not. If not, then an entry in selinuxfs would be appropriate. If we do want it to be persistent, our options include making it a policy primitive, a magic type attribute, or an semanage option. Of those, only the policy primitive requires changes to the policy parser. I don't have a strong opinion on this myself, though my gut reaction is that persistence is a useful property. - todd -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
