On Tue, 31 Mar 2009, Jarrett Lu wrote: > I'm in general agreement with you on this. I am not sure to what extent > the extensibility stuff makes sense, e.g. how much may be enough? I > guess we need to study more use scenarios. I suspect TE systems may have > more challenges in this area, just because security policies on TE > systems tend to be more flexible. For example, how many things are > critical in order to translate label correctly, OS version, vendor, > label parser, security policy file? How likely DTE systems are > configured with exact same policy files? Does it make sense that a > (harmless) update to security policy file causes label translation > failures from that point on? With SELinux systems, policies do not need to be identical to be considered part of the same DOI. Generally, labels need to remain semantically equivalent (i.e. mean the same thing on each system), and the policies need to be managed within the same administrative boundary. Systems may restrict which labels they'll interpret from remote systems (similar to root_squash). - James -- James Morris <jmorris@xxxxxxxxx> -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
