Josh, * Joshua Brindle (met...@manicmethod.com) wrote: > Stephen Frost wrote: >> I do think that, technically, there's no reason we couldn't allow for >> multiple "only-more-restrictive" models to be enabled and built in a >> single binary for systems which support it. As such, I would make those >> just "#if defined()" rather than "#elif". Let it be decided at runtime >> which are actually used, otherwise it becomes a much bigger problem for >> packagers too. > > It isn't just a case of using #if and it magically working. You'd need a > system to manage multiple labels on each object that can be addressed by > different systems. So instead of having an object mapped only to > "system_u:object_r:mydb_t:s15" you'd also have to have it mapped to, > eg., "^" for Smack.
I'm not sure I see that being a problem.. We're going to have
references in our object managers which make sense to us (eg: table
OIDs) and then a way of mapping those to some label (or possibly a set
of labels, as you describe). We might want to reconsider the catalog
structure a bit if we want to support more than one at a time, but I
don't see it as a huge problem to support more than one label existing
for a given object.
Thanks,
Stephen
signature.asc
Description: Digital signature
