On Tuesday 30 January 2007 05:43, Stephen Smalley <[EMAIL PROTECTED]> wrote: > True, but a system that disables proc is likely a system with a custom > policy anyway,
In practice we have to extensively customise policy long before getting to the non-proc stage of optimising for small hardware. The Familiar distribution (used on the iPaQ) has /proc but needs significant policy changes when compared to a typical Fedora workstation. Not only is there the issue that embedded distributions have different daemons and path names to workstations, but the memory constraints mean that even a modular targeted policy is not as small as you desire. > and dependency on proc is fairly basic to selinux these > days (due to reliance on /proc/self/attr for process attribute > manipulation in place of the old selinux syscalls). Possibly we should > just make selinux depend on proc and drop the #ifdef there. I think that is the correct thing to do. Someone who is prepared to do all the work needed to get a recent SE Linux system operating without /proc will have no problem changing the kernel config scripts and everyone else would be better off not being confused by being offered sets of options that are not viable. -- [EMAIL PROTECTED] http://etbe.blogspot.com/ My Blog http://www.coker.com.au/sponsorship.html Sponsoring Free Software development - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
