Messages in this thread | | | Date | Mon, 8 Mar 2010 19:17:49 +0000 | From | Alan Cox <> | Subject | Re: Upstream first policy |
| |
> always worked. I don't even understand why you have that crazy "either or" > mentality to begin with. Why? > > It's not "either pathname or inode". I'm saying _both_ make sense.
SELinux uses both. Things like "I put a file in my public_html directory" are a good example.
Its object based in the sense that the origin of the data might matter (eg 'no app which opens the credit card db creates a file httpd can send')
Its path based in the sense that public_html has a path based meaning by convention understood by httpd. Copy a jpeg into your public_html and it will be labelled up for http access under the Fedora shipped rule sets.
Alan
| |