Re: Proposal: new extension of selinux

I have a question about interface of PHP function. Is it a right manner to consider 'false' as an error condition on a function which returns string? For example, I defined the following wrapper functions: string selinux_getfscreatecon(void) It returns a security context for a new filesystem object in text representation, if it is explicitly configured. A process does not have this context in the default, so this function returns an empty string in most cases. However, we have to consider a possibility system returns an error status. This functions returns 'false' on errors. My point is whether we can discriminate between an empty string and a false value, or not. If inappropriate, it is necessary to design API specifications for them again. :( | $ php -r 'if ("" == false) { echo "T\n"; } else { echo "F\n"; }' | T | $ php -r 'if (is_string("")) { echo "T\n"; } else { echo "F\n"; }' | T | $ php -r 'if (is_string(false)) { echo "T\n"; } else { echo "F\n"; }' | F Hmm... Thanks, KaiGai Kohei wrote: > Hello, folks, > > I'm one of the developers in SELinux community. > Now I would like to propose a new extension which provides a set > of interfaces to communicate with SELinux. > > The following pages show you its specifications and implementations: > http://code.google.com/p/sepgsql/wiki/Memo_PHP_SELinux > > http://code.google.com/p/sepgsql/source/browse/misc/php-selinux/ > > Example: > $ php -r 'echo selinux_getcon()."\n";' > unconfined_u:unconfined_r:unconfined_t:SystemLow-SystemHigh > $ php -r 'echo selinux_getfilecon("/etc/shadow")."\n";' > system_u:object_r:shadow_t > $ php -r '$tclass = selinux_string_to_class("file"); > $avd = selinux_compute_av("staff_u:staff_r:staff_t:s0", > "system_u:object_r:etc_t:s0", > $tclass); > var_dump($avd);' > array(5) { > ["allowed"]=> > int(139347) > ["decided"]=> > int(-1) > ["auditallow"]=> > int(0) > ["auditdeny"]=> > int(-17) > ["seqno"]=> > int(4) > } > > Requirements: > - Linux kernel with SELinux enabled > - libselinux 2.0.46 or later > > I would like to release it as a part of PECL packages, and apply > "selinux" as its module name. Please comment anything. > > Thanks, -- OSS Platform Development Division, NEC KaiGai Kohei <kaigai@ak.jp.nec.com>