On Wed, Dec 12, 2012 at 3:46 PM, Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote: > You want loading SELinux policy to fail in this case, because > you know that the system isn't going to work properly. You are > suggesting a kernel change that inhibits loading the SELinux > policy unless userspace tells the kernel it is OK to do so > if present is not selinux. Now you get me. I just don't understand why all LSMs wouldn't want this. If they know they will fail, they should fail early and cleanly rather than unpredictably later. If you LSM can't fail due to attr issues, this doesn't apply. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
