[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Selinux: (not) "Black Voodoo Magic?"





7) Because m4 expansion is used, things are written in if-else statements (conditioned on things called booleans), and in functions/interfaces. This has the drawback of having a steep learning curve, because you might not be familiar with the other macros being called. I suggest use of grep, and http://serefpolicy.sourceforge.net/api-docs/ to figure it out. It would be absolutely wrong to write only low-level rules - the policy structure should model the program being confined. Things in a shared library should go into a shared interface.
arg... correction: Booleans are not handled via m4 expansion, they are part of the language (because their state is determined at runtime, not at compile time). There's:
   m4 ifelse construct - for conditional policy generation
   language if construct - for booleans, conditional policy at runtime



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]