Messages in this thread | | | Date | Fri, 29 Feb 2008 14:58:36 -0800 (PST) | From | Casey Schaufler <> | Subject | Re: [PATCH 01/11] Security: Add hook to get full maclabel xattr name |
| |
--- Dave Quigley <dpquigl@tycho.nsa.gov> wrote:
> > ... > > You need to give me a specific example of why if I have policy A on both > ends on an SELinux box that a secctx isn't the same on both boxes.
Trond can, and I'm completely confident he will, correct me if I'm wrong, but interoperability seems to require that you can't assume the perfect administration scenario. If you could, the name/value pair scheme would be perfectly viable, but Trond has very clearly explained why it is not reasonable to assume that.
But, for early going you may get away with telling people that the configuration has to be identical. They won't listen and will mess it up, but you will probably get away with it.
Casey Schaufler casey@schaufler-ca.com
| |