Is there any possibility of writing bundles of policies that can be "imported" into other configurations? Such as defining a package for a set of policies like "shared-libs", and then when writing the policy putting "import shared-libs" or something like that? Is this too much complex to do? Marcelo. <div>2008/2/22, Daniel J Walsh <<a href="mailto:dwalsh@redhat.com">dwalsh@redhat.com</a>>:<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bill Nottingham wrote: > I was writing policy today, and I couldn't help notice a lot of > repetitiveness in our policy: > > libs_use_ld_so(...) > libs_use_shared_libs(...) > > These are needed by, well, everything. Can't they be assumed-unless-denied? > > Similarly, 99% of confined apps need: > > miscfiles_read_localization() > files_read_etc_files(.) > pipes & stream sockets > > Is there a way to streamline policy so there is a lot less > repetition? > > Bill > > -- > fedora-selinux-list mailing list > <a href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a> We have talked about this in the past, and so far it has not gone anywhere. The original goal when refpolicy policy was first written was to allow more fine grained control then the example policy, which grouped large amounts of access rules within a single macro. (can_network) for example. So we wanted to avoid this, and perhaps the pendulum swung too far to the opposite degree. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (GNU/Linux) Comment: Using GnuPG with Fedora - <a href="http://enigmail.mozdev.org">http://enigmail.mozdev.org</a> iEYEARECAAYFAke+0oIACgkQrlYvE4MpobPd5gCfYpoWTHLDhsCf1Ae1oTQFv4dA AukAn0voXayQTmjDZm+AvEWoFyU2n/Rz =sl9z -----END PGP SIGNATURE----- -- fedora-selinux-list mailing list <a href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a> </blockquote></div>