Re: [apparmor] IPC syntax - again

2013-07-10 Thread Ángel González
Replying to differenet mails: now what of abstract sockets? They are the same as unix domain but begin with \0. We could use this notation or chose an alternate way of expressing it. network unix name=\0foo, or maybe network unix abstract=foo, Use an @, ie. network unix

Re: [apparmor] IPC syntax - again

2013-07-10 Thread John Johansen
On 07/10/2013 04:35 AM, Ángel González wrote: Replying to differenet mails: now what of abstract sockets? They are the same as unix domain but begin with \0. We could use this notation or chose an alternate way of expressing it. network unix name=\0foo, or maybe network unix

Re: [apparmor] IPC syntax - again

2013-07-10 Thread Seth Arnold
On Wed, Jul 10, 2013 at 01:35:35PM +0200, Ángel González wrote: Replying to differenet mails: now what of abstract sockets? They are the same as unix domain but begin with \0. We could use this notation or chose an alternate way of expressing it. network unix name=\0foo, or maybe

[apparmor] apparmor policy versioning

2013-07-10 Thread John Johansen
So it turns out we are going to need to support policy versioning (Christian can gloat now). The question because how we support it We are looking at 2 different options 1. we support a version tag in files, with the tag required to be on each file including any include. When the parser

Re: [apparmor] apparmor policy versioning

2013-07-10 Thread Seth Arnold
On Wed, Jul 10, 2013 at 02:18:22PM -0700, John Johansen wrote: So it turns out we are going to need to support policy versioning (Christian can gloat now). The question because how we support it I'm pretty sure I've seen a matrix somewhere that described the different mediation semantics and

Re: [apparmor] apparmor policy versioning

2013-07-10 Thread Jamie Strandboge
On 07/10/2013 04:18 PM, John Johansen wrote: So it turns out we are going to need to support policy versioning (Christian can gloat now). The question because how we support it We are looking at 2 different options 1. we support a version tag in files, with the tag required to be on each

Re: [apparmor] apparmor policy versioning

2013-07-10 Thread John Johansen
On 07/10/2013 02:51 PM, Seth Arnold wrote: On Wed, Jul 10, 2013 at 02:18:22PM -0700, John Johansen wrote: So it turns out we are going to need to support policy versioning (Christian can gloat now). The question because how we support it I'm pretty sure I've seen a matrix somewhere that