Messages in this thread | | | From | Russell Coker <> | Subject | Re: [PATCH] sysctl selinux: Don't look at table->de | Date | Tue, 30 Jan 2007 10:28:51 +1100 |
| |
On Tuesday 30 January 2007 05:43, Stephen Smalley <sds@tycho.nsa.gov> wrote: > True, but a system that disables proc is likely a system with a custom > policy anyway,
In practice we have to extensively customise policy long before getting to the non-proc stage of optimising for small hardware. The Familiar distribution (used on the iPaQ) has /proc but needs significant policy changes when compared to a typical Fedora workstation. Not only is there the issue that embedded distributions have different daemons and path names to workstations, but the memory constraints mean that even a modular targeted policy is not as small as you desire.
> and dependency on proc is fairly basic to selinux these > days (due to reliance on /proc/self/attr for process attribute > manipulation in place of the old selinux syscalls). Possibly we should > just make selinux depend on proc and drop the #ifdef there.
I think that is the correct thing to do. Someone who is prepared to do all the work needed to get a recent SE Linux system operating without /proc will have no problem changing the kernel config scripts and everyone else would be better off not being confused by being offered sets of options that are not viable.
-- russell@coker.com.au http://etbe.blogspot.com/ My Blog
http://www.coker.com.au/sponsorship.html Sponsoring Free Software development
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |