Re: [PATCH]Fix me add subj

On Tue, 2008-08-26 at 15:34 -0400, Steve Grubb wrote: > On Monday 18 August 2008 06:04:25 Chu Li wrote: > >   I have made a patch for "Fixme add subj" in auditd.c. This is for the > > latest codes. > > Now that the audit svn is open for new work...I started to apply this > patch. But then I got to thinking about SMACK. It probably does not like > us to get selinux labels. I was wondering if we need to try to get its > label, too? And I was wondering if both SE Linux and SMACK could be > running at the same time? If they can, do we collect both labels? They are exclusive of one another, and they both provide the process label via /proc/pid/attr/current.  libselinux wraps that kernel interface with getcon() (for current context) and getpidcon() (for context of a given pid), which internally handle the allocation of the buffer and will deal with label translation if using mcstransd. So if you want the code to work with either, you'd directly read /proc/pid/attr/current and display the resulting string.  If you want to be SELinux-specific and include functionality like MLS label translation, you'd use getpidcon(3).