Re: [apparmor] apparmor policy versioning

2013-07-18 Thread Jamie Strandboge
On 07/18/2013 07:24 PM, John Johansen wrote: On 07/18/2013 01:02 PM, Jamie Strandboge wrote: On 07/17/2013 05:57 PM, John Johansen wrote: On 07/11/2013 12:55 PM, Christian Boltz wrote: v2 policies can stay as v2 until we test them under v3 and then have them in both. I think we need to do it

Re: [apparmor] apparmor policy versioning

2013-07-17 Thread John Johansen
On 07/11/2013 12:55 PM, Christian Boltz wrote: Hello, Am Mittwoch, 10. Juli 2013 schrieb Jamie Strandboge: On 07/10/2013 04:18 PM, John Johansen wrote: So it turns out we are going to need to support policy versioning (Christian can gloat now). I already wanted it when we enforced the

Re: [apparmor] apparmor policy versioning

2013-07-11 Thread Christian Boltz
Hello, Am Mittwoch, 10. Juli 2013 schrieb Jamie Strandboge: On 07/10/2013 04:18 PM, John Johansen wrote: So it turns out we are going to need to support policy versioning (Christian can gloat now). I already wanted it when we enforced the trailing / on directory names some years ago ;-)

[apparmor] apparmor policy versioning

2013-07-10 Thread John Johansen
So it turns out we are going to need to support policy versioning (Christian can gloat now). The question because how we support it We are looking at 2 different options 1. we support a version tag in files, with the tag required to be on each file including any include. When the parser

Re: [apparmor] apparmor policy versioning

2013-07-10 Thread Seth Arnold
On Wed, Jul 10, 2013 at 02:18:22PM -0700, John Johansen wrote: So it turns out we are going to need to support policy versioning (Christian can gloat now). The question because how we support it I'm pretty sure I've seen a matrix somewhere that described the different mediation semantics and

Re: [apparmor] apparmor policy versioning

2013-07-10 Thread Jamie Strandboge
On 07/10/2013 04:18 PM, John Johansen wrote: So it turns out we are going to need to support policy versioning (Christian can gloat now). The question because how we support it We are looking at 2 different options 1. we support a version tag in files, with the tag required to be on each

Re: [apparmor] apparmor policy versioning

2013-07-10 Thread John Johansen
On 07/10/2013 02:51 PM, Seth Arnold wrote: On Wed, Jul 10, 2013 at 02:18:22PM -0700, John Johansen wrote: So it turns out we are going to need to support policy versioning (Christian can gloat now). The question because how we support it I'm pretty sure I've seen a matrix somewhere that