On Thu, 29 Jul 2010, Guillem Jover <[email protected]> wrote: > as they cannot be hardlinked it needs to create a new <pathname.dpkg-tmp> > symlink with the same contents as the <pathname> one. But as this one is > a newly created object it needs the permissions and SE Linux labels > applied to it, otherwise if we need to roll-back with rename(2) from > <pathname.dpkg-tmp> to <pathname> it would not have the correct metadata.
But why does that require a second context lookup? Why not cache the result of the first lookup? It's generally not going to change between calls - while it can change you have to keep in mind that any change to the policy is a heavy-weight operation that takes moderate amounts of system resources (you don't do it often) and if using the context that was used for the object a few seconds ago causes security problems then we have bigger problems than a dpkg race-condition. -- [email protected] http://etbe.coker.com.au/ My Main Blog http://doc.coker.com.au/ My Documents Blog -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
