These are not deprecated as far as i can see.
PATCH 2/2 These are not deprecated as far as i can see.
These seem to not be deprecated. Atleast, when i commented them out i got complaints when loading policy.
---
:100644 100644 1966443... 3257105... M policy/flask/access_vectors
policy/flask/access_vectors | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
policy/flask/access_vectors +2 -2
@@ -687,8 +687,8 @@ class packet send recv relabelto - flow_in # deprecated - flow_out # deprecated + flow_in + flow_out forward_in forward_out }
Signature · 9 lines
1.7.4 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20110214/c6f17549/attachment.bin
PATCH 2/2 These are not deprecated as far as i can see.
Quoted 1 line · Dominick Grift
These seem to not be deprecated. Atleast, when i commented them out i got complaints when loading policy.
No, they are deprecated. You can't just comment out the permissions in kernel object classes. They're still in the kernel, but not used. In the future, if we need new packet permissions, these could be reclaimed if necessary.
Quoted 28 lines
Signed-off-by Dominick Grift <[email protected]>---
:100644 100644 1966443... 3257105... M policy/flask/access_vectorspolicy/flask/access_vectors | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)policy/flask/access_vectors +2
-2@@ -687,8 +687,8 @@ class packet send recv relabelto - flow_in # deprecated - flow_out # deprecated + flow_in + flow_out forward_in forward_out }_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 2/2 These are not deprecated as far as i can see.
Quoted 14 lines · Christopher J. PeBenito
Quoted 1 line · Dominick Grift
These seem to not be deprecated. Atleast, when i commented them out i got complaints when loading policy.
No, they are deprecated. You can't just comment out the permissions in kernel object classes. They're still in the kernel, but not used. In the future, if we need new packet permissions, these could be reclaimed if necessary.
Quoted 6 lines
Signed-off-by Dominick Grift <[email protected]>---
:100644 100644 1966443... 3257105... M policy/flask/access_vectorspolicy/flask/access_vectors | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
Quoted 15 lines
Quoted 5 lines
policy/flask/access_vectors +0
-0policy/flask/access_vectors class packet · line 694
Quoted 10 lines
policy/flask/access_vectors +2
-2@@ -687,8 +687,8 @@ class packet send recv relabelto - flow_in # deprecated - flow_out # deprecated + flow_in + flow_out forward_in forward_out }
Eric - while we can't remove these permissions without breaking certain old Fedora kernels, can't we remove them from the classmap.h definitions in the modern kernels as they are not being used (and never were used by any mainline kernel?)?
Signature · 2 lines
Stephen Smalley National Security Agency
PATCH 2/2 These are not deprecated as far as i can see.
Quoted 27 lines · Stephen Smalley
Quoted 26 lines · Christopher J. PeBenito
Quoted 1 line · Dominick Grift
These seem to not be deprecated. Atleast, when i commented them out i got complaints when loading policy.
No, they are deprecated. ?You can't just comment out the permissions in kernel object classes. ?They're still in the kernel, but not used. ?In the future, if we need new packet permissions, these could be reclaimed if necessary.
Quoted 18 lines
Signed-off-by Dominick Grift <[email protected]>---
:100644 100644 1966443... 3257105... M ? ? ?policy/flask/access_vectors ?policy/flask/access_vectors | ? ?4 ++--
?1 files changed, 2 insertions(+), 2 deletions(-)policy/flask/access_vectors +0
-0@@ -687,8 +687,8 @@ class packet? ? send
? ? recv
? ? relabelto
- ?flow_in? ? ? ? # deprecated
- ?flow_out? ? ? ?# deprecated
+ ?flow_in
+ ?flow_out
Quoted 8 lines
Quoted 3 lines
Quoted 3 lines
? ?
forward_in
? ?forward_out
?}Eric - while we can't remove these permissions without breaking certain old Fedora kernels, can't we remove them from the
classmap.hdefinitions in the modern kernels as they are not being used (and never were used by any mainline kernel?)?
I don't see why not. I'll send a patch in a bit.
-Eric