FC3... install/update ?

[Tom London]

With FC3 about to descend, anyone know if updates
from FC2 will be supported?  Only clean installs?

Any thoughts on SELinux-related areas needing attention?

tom

[Florian La Roche]

On Thu, Jul 08, 2004 at 10:29:23AM -0700, Tom London wrote:
>  With FC3 about to descend, anyone know if updates
>  from FC2 will be supported?  Only clean installs? 
We certainly want to hear about breakages and check if
those can get fixed.

greetings,

Florian La Roche

>  
>  Any thoughts on SELinux-related areas needing attention?
>  
>  tom
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Stephen Smalley]

On Thu, 2004-07-08 at 13:29, Tom London wrote:
>  With FC3 about to descend, anyone know if updates
>  from FC2 will be supported?  Only clean installs? 
Are updates ever "supported"?  In any event, I've been tracking rawhide
regularly via yum update so far, and haven't had any significant
problems.

>  Any thoughts on SELinux-related areas needing attention? 
usermode (userhelper) and sudo are still in flux, expect changes soon
both to the code and the policy.  Integrated user management is still a
major area needing improvement, as most Fedora SELinux users are not
maintaining policy/users at present for individual users (beyond
system_u/user_u/root distinctions) due to the lack of such integration
and thus cannot take full advantage of roles.  setools and setools-gui
includes some tools for managing SELinux users, but there is nothing
today to deal with distributed user databases, e.g. NIS or LDAP.  In
general, policy management tools that are more oriented toward sysadmins
rather than security analysts are needed.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Robert P. J. Day]

On Thu, 8 Jul 2004, Stephen Smalley wrote:

>  On Thu, 2004-07-08 at 13:29, Tom London wrote:
> > With FC3 about to descend, anyone know if updates
> > from FC2 will be supported?  Only clean installs?
>
>  Are updates ever "supported"?  In any event, I've been tracking rawhide
>  regularly via yum update so far, and haven't had any significant
>  problems. 
*theoretically*, you should be able to update.  the rules are really 
quite simple -- technically, you should be able to update from any 
*official* release to a subsequent release (within reason, of course), 
whether that subsequent release is real or test.  think about it -- 
FC3t1 is supposed to represent the first pass at FC3.  so i'm sure the 
FC folks would really like some people to at least take a shot at the 
update, to help work the bugs out.

just back up first. :-)

rday

[Mike Fedyk]

Stephen Smalley wrote:

> includes some tools for managing SELinux users, but there is nothing
> today to deal with distributed user databases, e.g. NIS or LDAP.  In
>   
>  
There is Directory Administrator that currently works with LDAP user 
databases. 

It is gnome based, so it should fit well with the rest of FC, and I'm 
sure support for NIS could be added also.

[Stephen Smalley]

On Thu, 2004-07-08 at 14:15, Mike Fedyk wrote:
>  There is Directory Administrator that currently works with LDAP user
>
>  databases. 
>  
>  It is gnome based, so it should fit well with the rest of FC, and I'm 
>  sure support for NIS could be added also. 
Sorry, I meant that there is nothing today to integrate distributed user
databases such as NIS or LDAP with the SELinux policy user database.  
Not that Fedora itself lacks support for such things; we just lack the
infrastructure to link them with SELinux at present, and doing so safely
isn't trivial.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Stephen Smalley]

On Thu, 2004-07-08 at 13:29, Tom London wrote:
>  With FC3 about to descend, anyone know if updates
>  from FC2 will be supported?  Only clean installs? 
Caveat:  I think you need to do a 'yum upgrade' rather than a 'yum
update' from FC2 to pick up the policy -> selinux-policy-strict update. 
A 'yum update' seems to leave the old policy package unchanged, while
pulling in the newer SysVinit, libselinux, and policycoreutils (which do
still work with the older policy package, but that isn't likely what you
want).

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Jonathan Rawle]

Tom London wrote:

>  With FC3 about to descend, anyone know if updates
>  from FC2 will be supported?  Only clean installs?
>  
>  Any thoughts on SELinux-related areas needing attention? 
Presumably SELinux will only be installed with fresh FC3 installs, or
upgrades from FC2 with SELinux?

The default for FC2 was not to enable SELinux, so most people won't get
SELinux when they upgrade to FC3 unless they do a fresh install.
(This was the case with the graphical boot in the upgrade to FC1 from RH9 -
a trivial matter by comparison, but it generated a lot of discussion on the
list of the type "Where is the graphical boot"...)

Jonathan

[Stephen Smalley]

On Mon, 2004-07-12 at 10:59, Jonathan Rawle wrote:
>  Presumably SELinux will only be installed with fresh FC3 installs,
> or
>  upgrades from FC2 with SELinux?
>  
>  The default for FC2 was not to enable SELinux, so most people won't get
>  SELinux when they upgrade to FC3 unless they do a fresh install.
>  (This was the case with the graphical boot in the upgrade to FC1 from RH9 -
>  a trivial matter by comparison, but it generated a lot of discussion on the
>  list of the type "Where is the graphical boot"...) 
I think that this is true, but am not certain.  I would expect the
following behavior:
1) Upgrade from FC2/non-SELinux => stays non-SELinux
2) Upgrade from FC2/SELinux => stays SELinux, but replaces policy with
selinux-policy-strict.
3) Fresh install => defaults to SELinux with selinux-policy-targeted,
but selectable at install time

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency