-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/19/2011 11:31 AM, Joshua Brindle wrote: > Christopher J. PeBenito wrote: >> On 10/14/11 11:57, Daniel J Walsh wrote: >>> Eric and I have come up with the following syntax for this >>> behaviour. >>> >>> default_trans level dir_file_class_set parent; >> >> I think we want this to be "range" instead of "level", since the >> field is actually a range. >> >>> default_trans user dir_file_class_set process; default_trans >>> role file parent; >> >> Isn't there a better set of tokens than this? Why not make it >> default_user, default_role, default_type, and default_range? >> Creating an object doesn't really imply a transition, so "trans" >> seems misleading. >> > > I agree with Chris. This will actually let you make things not > transition by default so _trans is misleading. Further, "process" > shouldn't be a token since it is an object class (you couldn't > actually parse policy with Eric's patches could you?). I don't like > "parent" as a token either, and SELinux doesn't know anything about > processes and parents anyway. SDS's suggestions a while back are > more appropriate IMO, since SELinux does know what source and > target are. > > -- This message was distributed to subscribers of the selinux > mailing list. If you no longer wish to subscribe, send mail to > majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" > without quotes as the message. > > We can parse and you are allowed to use process in both places. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk6fC74ACgkQrlYvE4MpobPZdgCgnc/98H1ZvyOlDvqgQZdJjLkn KlsAn2RIHOa/tN9qH9mPfbdHoQacetC+ =YPYh -----END PGP SIGNATURE----- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
