On Sun, 2006-28-05 at 23:36 -0700, David Miller wrote: [..] > > More to the point I think that none of this will be handled > transparently unless the onus is put on new netlink module users. > Ie. make the register of a netlink subsystem user (either direct > netlink or via generic netlink) fail if the operations don't > provide the SELinux handlers. > > Otherwise, the SELinux folks will continually be playing catchup > writing the handlers. That doesn't scale.
The scaling problem may be more related to SELinux trying to have ultimate knowledge of all the subsystems classification. It breaks when it is something that is not simple as a type (as in this case). If SELinux should provide ways to add "filters" more dynamically at its hooks - instead of having people go and look for that table and update it then it would simplify things and we may be able to easily have netlink users to register such filters at startup; infact we may be able to hide this from the users in genetlink. One could argue that if SELinux is capable of adding such filters at its hooks, then the problem could be moved to user space policy perhaps? cheers, jamal - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
