Re: [RFC] Install SELinux policies from rpm package header

[Joshua Brindle <method@manicmethod.com>]

Paul Moore wrote:
> On Thursday 09 July 2009 05:13:20 pm Chad Sellers wrote:
>> On 7/9/09 4:48 PM, "Daniel J Walsh"<dwalsh@redhat.com>  wrote:
>> <snip>
>>
>>> A couple of other problems with including policy with each rpm.  How do
>>> you handle different packaging.  MLS, Targeted, minimal.
>> That is a problem we'll have to solve, but I don't think it will be too
>> difficult. We could easily provide an option to the %policy directive that
>> could direct rpm to use a particular policy store.
>
> Would that mean we could end up in a situation where a RPM only installs
> policy modules for a particular policy type, e.g. apache only installs a
> targeted policy module?  That seems like it could lead to real problems down
> the line as individual RPMs get this wrong.  Also, what happens at the unknown
> point in the future when we change from targeted as the de-facto default to
> some other name?
>

I think if you don't list a store name explicitly it goes to default, I suspect 
that will be used in most cases. Regardless of this work we need some standard 
store names because otherwise instructions and blog entries and wherever else 
people get information about installing minimal or mls policies will be wrong.

> I like what you are trying to do here, it just scares me a little bit thinking
> about all the details (and I'm sure I'm only thinking about a small number of
> them too).
>

There are devils in the details for sure, we are just talking first steps for now.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.