Re: Troubles in http://pecl.php.net/account-request.php ?

Johannes Schlüter wrote:

On Thu, 2009-02-26 at 14:31 +0900, KaiGai Kohei wrote:

From the pecl-dev list archives, I seems to me an initial implementation can be required, as I currently put it on the google code repository.

We don'T actually have a strong process here. It's more a "yes, seems valid and the request is serious.

Yes, this request is serious. We currently have no interface to communicate with SELinux from PHP script. So, I would like to get an account to develop a module named as "selinux", and documentation tree in same name.

Please tell me, if something incorrect.

I think the addition is fine. I had a short look at the code and some minor comments there: - Why do you need the #if HAVE_SELINUX in selinux.c? Whether the file is being compiled should be controlled by the config.m4 so there should be no need for that check

Maybe, it came from a mimicry of other extension. But it indeed unnecessary now.

- You do a RETURN_FALSE when zend_parse_parameters fails usually we return NULL while there are some exceptions (like null having a special meaning in that case or historic reasons ...)

Does it means simple "return;" like: http://cvs.php.net/viewvc.cgi/pecl/xattr/xattr.c?revision=1.12&view=markup or, using "RETURN_NULL();" ? I'll follow the preferable mannar for PECL packages. Thanks,

Small things, no show-stoppers or anything. johannes

I posted the following proposal for a few days ago. ------------------------------------------------------------ Hello, folks, I'm one of the developers in SELinux community. Now I would like to propose a new extension which provides a set of interfaces to communicate with SELinux. The following pages show you its specifications and implementations: http://code.google.com/p/sepgsql/wiki/Memo_PHP_SELinux http://code.google.com/p/sepgsql/source/browse/misc/php-selinux/ Example: $ php -r 'echo selinux_getcon()."\n";' unconfined_u:unconfined_r:unconfined_t:SystemLow-SystemHigh $ php -r 'echo selinux_getfilecon("/etc/shadow")."\n";' system_u:object_r:shadow_t $ php -r '$tclass = selinux_string_to_class("file");

          $avd = selinux_compute_av("staff_u:staff_r:staff_t:s0",
                                    "system_u:object_r:etc_t:s0",
                                    $tclass);
          var_dump($avd);'

array(5) { ["allowed"]=> int(139347) ["decided"]=> int(-1) ["auditallow"]=> int(0) ["auditdeny"]=> int(-17) ["seqno"]=> int(4) } Requirements: - Linux kernel with SELinux enabled - libselinux 2.0.46 or later I would like to release it as a part of PECL packages, and apply "selinux" as its module name. Please comment anything. Thanks,

-- OSS Platform Development Division, NEC KaiGai Kohei <kaigai@ak.jp.nec.com>