SELinux-Refpolicy Archive on lore.kernel.org
 help / color / Atom feed
* Re: Testing changes to "refpolicy"
       [not found] <fb70d47d-abb5-7dfd-e0c1-bc8eca28cba8@oracle.com>
@ 2019-04-09 12:02 ` Chris PeBenito
  2019-04-09 15:58   ` Jag Raman
  0 siblings, 1 reply; 3+ messages in thread
From: Chris PeBenito @ 2019-04-09 12:02 UTC (permalink / raw)
  To: Jag Raman, refpolicy

On 4/8/19 11:05 AM, Jag Raman wrote:
> Hi,
> 
> I need some help with testing "refpolicy".
> 
> I'm able to install and load the refpolicy. But I'm unable
> to switch to "enforcing" mode because the OS (Fedora29)
> hangs due to missing policies.
> 
> What distro of Linux are we expected to use for testing it?
> 
> Are there any patches that should be applied on top of it?
> If so where could it be found? I'm trying to find out how
> you test changes to the refpolicy.
> 
> Thank you very much!

Please note the new refpolicy list. [1]

There is no official distro for testing.  It does support customizations 
for various distributions (DISTRO build option), but that also depends 
on how much of the distro's customizations are upstreamed.

[1] http://vger.kernel.org/vger-lists.html#selinux-refpolicy

-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: Testing changes to "refpolicy"
  2019-04-09 12:02 ` Testing changes to "refpolicy" Chris PeBenito
@ 2019-04-09 15:58   ` Jag Raman
  2019-04-10  0:59     ` Russell Coker
  0 siblings, 1 reply; 3+ messages in thread
From: Jag Raman @ 2019-04-09 15:58 UTC (permalink / raw)
  To: refpolicy, selinux-refpolicy; +Cc: Chris PeBenito

On 4/9/2019 8:02 AM, Chris PeBenito wrote:
> On 4/8/19 11:05 AM, Jag Raman wrote:
>> Hi,
>>
>> I need some help with testing "refpolicy".
>>
>> I'm able to install and load the refpolicy. But I'm unable
>> to switch to "enforcing" mode because the OS (Fedora29)
>> hangs due to missing policies.
>>
>> What distro of Linux are we expected to use for testing it?
>>
>> Are there any patches that should be applied on top of it?
>> If so where could it be found? I'm trying to find out how
>> you test changes to the refpolicy.
>>
>> Thank you very much!
> 

Hi Chris,

Thanks for your response.

> Please note the new refpolicy list. [1]

Sorry about this. I've subscribed to the new list, and added it to this
email.

> 
> There is no official distro for testing.  It does support customizations 
> for various distributions (DISTRO build option), but that also depends 
> on how much of the distro's customizations are upstreamed.

I tried setting the "DISTRO" build option to "redhat", and tested on
Fedora. But it looks like "refpolicy" customizations are not upstream
for Fedora. It could be because RedHat is maintaining a separate set of
patches [2] that apply on top of an older version (RELEASE_2_20130424)
of SELinux refpolicy.

Do you know of any distro whose customizations are upstream?

[2] https://git.centos.org/summary/?r=rpms/selinux-policy.git

Thanks!
--
Jag

> 
> [1] http://vger.kernel.org/vger-lists.html#selinux-refpolicy
>

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: Testing changes to "refpolicy"
  2019-04-09 15:58   ` Jag Raman
@ 2019-04-10  0:59     ` Russell Coker
  0 siblings, 0 replies; 3+ messages in thread
From: Russell Coker @ 2019-04-10  0:59 UTC (permalink / raw)
  To: Jag Raman; +Cc: refpolicy, Chris PeBenito

On Wednesday, 10 April 2019 1:58:28 AM AEST Jag Raman wrote:
> > There is no official distro for testing.  It does support customizations
> > for various distributions (DISTRO build option), but that also depends
> > on how much of the distro's customizations are upstreamed.
> 
> I tried setting the "DISTRO" build option to "redhat", and tested on
> Fedora. But it looks like "refpolicy" customizations are not upstream
> for Fedora. It could be because RedHat is maintaining a separate set of
> patches [2] that apply on top of an older version (RELEASE_2_20130424)
> of SELinux refpolicy.
> 
> Do you know of any distro whose customizations are upstream?

The vast majority of Debian patches are upstreamed.  A couple of months ago I 
submitted a lot of patches to get the Debian policy very close to upstream, 
the differences at that time were mostly things that upstream didn't agree 
with.

Since that time there have been more changes and one particularly noteworthy 
thing is that there's been a new release of systemd that needs some changes.  
I plan to have all the patches needed for that submitted upstream soon.

If you run Debian/Testing with the upstream policy there is about 10 minutes 
work needed to get it all going properly.  If you find it more difficult than 
that then let me know and I'll fix it.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/




^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <fb70d47d-abb5-7dfd-e0c1-bc8eca28cba8@oracle.com>
2019-04-09 12:02 ` Testing changes to "refpolicy" Chris PeBenito
2019-04-09 15:58   ` Jag Raman
2019-04-10  0:59     ` Russell Coker

SELinux-Refpolicy Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux-refpolicy/0 selinux-refpolicy/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux-refpolicy selinux-refpolicy/ https://lore.kernel.org/selinux-refpolicy \
		selinux-refpolicy@vger.kernel.org selinux-refpolicy@archiver.kernel.org
	public-inbox-index selinux-refpolicy

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux-refpolicy


AGPL code for this site: git clone https://public-inbox.org/ public-inbox