Re: Upstream first policy

From: Alan Cox
Date: Mon Mar 08 2010 - 14:19:05 EST

> always worked. I don't even understand why you have that crazy "either or"
> mentality to begin with. Why?
> It's not "either pathname or inode". I'm saying _both_ make sense.

SELinux uses both. Things like "I put a file in my public_html directory"
are a good example.

Its object based in the sense that the origin of the data might matter
(eg 'no app which opens the credit card db creates a file httpd can send')

Its path based in the sense that public_html has a path based meaning by
convention understood by httpd. Copy a jpeg into your public_html and it
will be labelled up for http access under the Fedora shipped rule sets.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at