[RFC] /var versus /srv
jkeating at redhat.com
Thu Sep 27 20:18:08 UTC 2007
On Thu, 27 Sep 2007 15:53:38 -0400
Karl MacMillan <kmacmill at redhat.com> wrote:
> 3) Have rpm set contexts that aren't yet valid. This option was
> explored and there was even a kernel patch that would allow this. The
> fear is that it would allow a malicious package to create files with
> _any_ context that is not yet valid. It makes it difficult or
> impossible to constrain rpm. You could go back after the policy is
> installed and check for contexts that are still invalid and fix
> those. No decision was reached about how to handle the hole and
> nothing happened. The SELinux upstream developers (well, at least me)
> are willing to reconsider this proposal.
Wouldn't it be reasonable to lay them down as 'undefined_t' and let the
post-rpm transactions relabel them?
Fedora -- All my bits are free, are yours?
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 189 bytes
Desc: not available
More information about the fedora-devel-list