[RFC] /var versus /srv

[Jesse Keating]

On Thu, 27 Sep 2007 15:53:38 -0400
Karl MacMillan <kmacmill at redhat.com> wrote:

> 3) Have rpm set contexts that aren't yet valid. This option was
> explored and there was even a kernel patch that would allow this. The
> fear is that it would allow a malicious package to create files with
> _any_ context that is not yet valid. It makes it difficult or
> impossible to constrain rpm. You could go back after the policy is
> installed and check for contexts that are still invalid and fix
> those. No decision was reached about how to handle the hole and
> nothing happened. The SELinux upstream developers (well, at least me)
> are willing to reconsider this proposal.

Wouldn't it be reasonable to lay them down as 'undefined_t' and let the
post-rpm transactions relabel them?

-- 
Jesse Keating
Fedora -- All my bits are free, are yours?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-devel-list/attachments/20070927/76f860e7/attachment.sig>