On Wed, 2013-10-30 at 11:53 -0400, Daniel J Walsh wrote:
Well in this case I would like to potentially run these container/apps with Types like firefox_t and ooffice_t, but more generically with app_t where app_t is not allowed to touch user_home_t.
But we are going far a field of this email chain, and we can revisit this when we actually have applications containers.
Sure, we will see, and yes i guess containers in Gnome are inevitable anyways (what about other DE's). I think, but you probably already know that, that we should not try to prevent access to the generic user home content type user_home_t, but instead classify everything that is not generic.
Anyways the difference is that i have integrity enforcement on the desktop currently implemented (albeit somewhat limited), and what you are suggesting is something that might work in a distant future.
</thread>