Re: [PATCH] selinux: support wildcard match in genfscon

On Tue, Dec 17, 2024 at 8:38 PM Takaya Saeki <[email protected]> wrote:
> >
> > The speed at which a new nice-to-have feature can be adopted is
> > generally not something I worry about, it's a new *feature*, not a bug
> > fix so if it takes some time to be fully adopted that is okay.  What I
> > do concern myself about is the quality and long term maintainability
> > of the kernel code, especially when user visible changes are
> > concerned.  Adding kernel complexity for changes like this, especially
> > when they can be handled in userspace is almost always going to be a
> > no-go as far as I'm concerned.
>
> The perspective of long term maintainability being more important is completely
> understandable. Also, your comments on the other alternatives are well-taken.
> Thank you very much for your input. Then, I will update my patch based on the
> full match, also reflecting your review comments.
>
> In the meantime, I'd like to confirm one remaining option that we haven't yet
> discussed, just to consider all possibilities. If the concern is primarily
> about the implementation rather than the behavior itself, would it be feasible
> to implement prefix matching using a dedicated helper function instead of using
> a trailing wildcard character like '*'?"

While adding a helper function instead of a direct wildcard
concatenation would change the implementation slightly, the higher
level concerns around added complexity remain, and for that reason I
remain opposed to such an approach.

-- 
paul-moore.com