On 08/05/2011 12:58 PM, James Carter wrote: > On Fri, 2011-08-05 at 08:56 -0400, Stephen Smalley wrote: >> I don't think we should introduce an incompatible policy language change >> without very strong reasons. It is fine to introduce new constructs >> like your role...attribute construct, but we shouldn't change the >> meaning of role...type statements and thereby render invalid policies >> that used to be valid. >> > > In the up and coming CIL compiler, declaration and use are always > separate, so user, role, and type rules are only used to declare. There > are typealias, typeattribute, and other such rules to define > associations. For a role there is a separate roletype rule to associate > a type with a role. > > So if roletype and roleattribute rules were created for the current > toolchain, the current role rule would not have to be changed. Newer > policies could use the role rule only to declare a role, but it could > still be used in the old way for backwards compatibility. Sounds to me like there is enough interest in compatiblity that we should make the current toolchain continue to allow the old role X type Y rules to also be a declaration. In the new CIL toolchain we will make the syntax more strict and require better policy definitions. Harry, is this patch something you can take a moment and write? Thanks! -Eric -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
