Re: [PATCH v6 1/2] selinux: add brief info to policydb

From	Sebastien Buisson <sbuisson.ddn@gmail.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH v6 1/2] selinux: add brief info to policydb
Date	2017-05-24 17:30 +0200
Message-ID	<tKGoz-43s-21@gated-at.bofh.it> (permalink)
References	(2 earlier) <tIu8a-3sl-11@gated-at.bofh.it> <tIvdU-4qH-25@gated-at.bofh.it> <tIBsZ-ET-1@gated-at.bofh.it> <tKl0L-5Ft-27@gated-at.bofh.it> <tKnvz-7vn-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

2017-05-23 21:11 GMT+02:00 Paul Moore <paul@paul-moore.com>:
> On Tue, May 23, 2017 at 12:29 PM, Sebastien Buisson
> <sbuisson.ddn@gmail.com> wrote:
>> Another way could be to add another hook to check policy brief info
>> validity. It would take a string as an input parameter, and return 0
>> if it matches the current policy. So Lustre client code would
>> systematically call this hook, and only call security_policydb_brief()
>> when the policy has changed, to store the current value internally.
>
> I'm not sure I like this approach as much as the one above, for a
> variety of reasons.  Is this option more desirable from a Lustre point
> of view?

It is true that now that the notification code is present in the
selinux/next branch, it is worth using it. I was thinking, but I may
be wrong, that future inclusion of this series of patches in some
distributions' kernels like CentOS or RedHat would be easier if it did
not have dependencies on other patches. This is why I thought about an
alternative solution.
Technically speaking, the solution based on notifications can fit the
Lustre needs, letting Lustre maintain its own sequence number as you
suggest.

Sebastien.

Thread

[PATCH v6 1/2] selinux: add brief info to policydb Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-05-17 19:20 +0200
  [PATCH v6 2/2] selinux: expose policy brief via selinuxfs Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-05-17 19:20 +0200
  Re: [PATCH v6 1/2] selinux: add brief info to policydb Stephen Smalley <sds@tycho.nsa.gov> - 2017-05-17 20:30 +0200
    Re: [PATCH v6 1/2] selinux: add brief info to policydb William Roberts <bill.c.roberts@gmail.com> - 2017-05-17 21:10 +0200
  Re: [PATCH v6 1/2] selinux: add brief info to policydb Paul Moore <paul@paul-moore.com> - 2017-05-18 00:20 +0200
    Re: [PATCH v6 1/2] selinux: add brief info to policydb Stephen Smalley <sds@tycho.nsa.gov> - 2017-05-18 16:00 +0200
      Re: [PATCH v6 1/2] selinux: add brief info to policydb Stephen Smalley <sds@tycho.nsa.gov> - 2017-05-18 17:10 +0200
        Re: [PATCH v6 1/2] selinux: add brief info to policydb Paul Moore <paul@paul-moore.com> - 2017-05-18 23:50 +0200
          Re: [PATCH v6 1/2] selinux: add brief info to policydb Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-05-23 18:40 +0200
            Re: [PATCH v6 1/2] selinux: add brief info to policydb Paul Moore <paul@paul-moore.com> - 2017-05-23 21:20 +0200
              Re: [PATCH v6 1/2] selinux: add brief info to policydb Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-05-24 17:30 +0200
            Re: [PATCH v6 1/2] selinux: add brief info to policydb Stephen Smalley <sds@tycho.nsa.gov> - 2017-05-23 21:50 +0200
              Re: [PATCH v6 1/2] selinux: add brief info to policydb Sebastien Buisson <sbuisson.ddn@gmail.com> - 2017-05-24 18:00 +0200

csiph-web