On 03/22/2013 11:23 AM, Richard Haines wrote:
Thanks for the quick response. I did read the mac_permissions.xml comments
but must have suffered word blindness by the time I got to:
* Strict enforcing of any xml stanza is not enforced in most cases. This
mainly applies to duplicate tags which are allowed. In the event that a tag
already exists, the original tag is replaced.
Richard
If we did adopt such a scenario where multiple same-cert stanzas are
acceptable then I would imagine we would be baffled by the following:
<signer signature="-sigA-">
<allow-all/>
<seinfo value="a"/>
</signature>
<signer signature="-sigA-">
<allow-all/>
<seinfo value="b"/>
</signature>
Thus I just choice to replace the original in all ambiguous cases.
Maybe part of the solution is to bring in a checkpolicy component to
mac_permissions.xml that is run on the final mac_permissions.xml file
before the system image built. Thus it could enforce the rule you've
encountered. I have some code to do this but it is still undergoing some
internal review.
--
This message was distributed to subscribers of the seandroid-list mailing list.
If you no longer wish to subscribe, send mail to majord...@tycho.nsa.gov with
the words "unsubscribe seandroid-list" without quotes as the message.
