Discussion:
[tomoyo-users-en 613] Better information on load-policy behavior?
(too old to reply)
Ryan Seu
2014-12-18 22:33:42 UTC
Permalink
Raw Message
Hey folks,

Can anyone provide more information on how tomoyo-loadpolicy behaves? I can
probably look through the code but figure I would ask here first.

We're managing tomoyo via puppet and we're trying to figure out how to
load/update policy in a clean and safe manner.

We invoke the loadpolicy periodically via a cron job which is managed by
puppet. Unfortunately we also protect cron behind tomoyo which means that
when we use the overwrite flag (-ef) everything that's currently applied
gets flushed and things go to a complete lockdown mode.

What's the functional difference between -ef and -e? How does the appending
work? What I made changes to the full existing policy and try to load it?

Thank you!
Ryan
Toshiharu Harada
2014-12-19 08:09:45 UTC
Permalink
Raw Message
Hi Ryan,
Post by Ryan Seu
Hey folks,
Can anyone provide more information on how tomoyo-loadpolicy behaves? I
can probably look through the code but figure I would ask here first.
We're managing tomoyo via puppet and we're trying to figure out how to
load/update policy in a clean and safe manner.
We invoke the loadpolicy periodically via a cron job which is managed by
puppet. Unfortunately we also protect cron behind tomoyo which means that
when we use the overwrite flag (-ef) everything that's currently applied
gets flushed and things go to a complete lockdown mode.
If you invoke loadpolicy with the flag (-ef), it first clears up the
existing policy
while the flag (-e) simply appends/deletes.
Cases you need the flag (-ef) is quite limited and I assume your don't want
it this time.
Post by Ryan Seu
What's the functional difference between -ef and -e? How does the
appending work? What I made changes to the full existing policy and try to
load it?
I assume that what you want to do is keeping update (patch) the policy and
finally save it to files.
If so, invoke loadpolicy with the flag (-e) and savepolicy when you get
ready.
Post by Ryan Seu
Thank you!
Ryan
Best regards,

Toshiharu Harada
***@gmail.com

Loading...