From:   Russell Coker <russell@coker.com.au>
To:     Dominick Grift <dac.override@gmail.com>
Cc:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: nnp_transition
Date:   Tue, 22 Jan 2019 19:33:53 +1100
Message-ID: <8870278.Oar1g5JlLj@liv>
In-Reply-To: <87fttlyuv7.fsf@gmail.com>
References: <6525171.sqPiMeOL83@liv> <87fttlyuv7.fsf@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Tuesday, 22 January 2019 7:11:40 PM AEDT Dominick Grift wrote:
> > Getting close to a Debian release so I have to sort out the nnp_transition
> > rules.  How do I work out what's going on here?  Do I just assume that as
> > dpkg_t has generally less access than unconfined_t it's ok?  Is it worth
> > investigating why something in apt is setting NNP?
> 
> Not worth looking into if you ask me (this is just the tip of the mountain).
> You no longer have to worry about type bounds if you enable the polcap
> (which i think is the default)

What do you mean by "enable the polcap"?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/