[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [RFC] /var versus /srv



On Thu, 27 Sep 2007 15:53:38 -0400
Karl MacMillan <kmacmill redhat com> wrote:

> 3) Have rpm set contexts that aren't yet valid. This option was
> explored and there was even a kernel patch that would allow this. The
> fear is that it would allow a malicious package to create files with
> _any_ context that is not yet valid. It makes it difficult or
> impossible to constrain rpm. You could go back after the policy is
> installed and check for contexts that are still invalid and fix
> those. No decision was reached about how to handle the hole and
> nothing happened. The SELinux upstream developers (well, at least me)
> are willing to reconsider this proposal.

Wouldn't it be reasonable to lay them down as 'undefined_t' and let the
post-rpm transactions relabel them?

-- 
Jesse Keating
Fedora -- All my bits are free, are yours?

Attachment: signature.asc
Description: PGP signature


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]