On Wed, 2009-02-04 at 22:30 +0800, xing li wrote: > > Hello all, > > I knew that selinux use the mechanism of netlink > to broadcast the event of policy changing. such as > > selnl_notify_policyload(seqno); but i could't find the receiver (some > object manager) to handle it? It is handled by the userspace AVC code in libselinux. See libselinux/src/avc_internal.c. > and according to the Technical Reports of selinux, i also knew the avc > in selinux resolved the problem about > > revocation of migrated permissions, but how do implement it? avc_reset() flushes the cache state and then invokes any callbacks registered by the object manager code to revoke migrated permissions. But complete revocation is not fully implemented in SELinux, and some of the revocation is handled by revalidation of access on use (e.g. on read/write). -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
