Re: rpms/pam_ssh/F-8 pam_ssh.te,NONE,1.1 pam_ssh.spec,1.13,1.14

[Dmitry Butskoy]

[snip]

>   Requires: openssh-clients
>  +Requires: policycoreutils
>   BuildRequires: pam-devel, openssh-clients, openssl-devel 
[snip]

>  +
>  +%post
>  +semodule -i %{_datadir}/selinux/packages/%{name}/%{name}.pp || :
>  +
>  +%postun
>  +if [ "$1" -eq "0" ]; then
>  +  semodule -r %{module} || :
>  +fi
>     
AFAIK a lot of people just do not use SELinux and even prefer to remove 
its packages. It seems to me that a hard requirement of 
"policycoreutils" is not a good thing here.

Maybe just check in %post and %postun whether the "semodule" binary is 
present (i.e., "[ -x /usr/sbin/semodule ] && ....")?  Or use %triggerin

for policycoreutils...

How another packages deal with similar things?


Dmitry Butskoy
http://www.fedoraproject.org/wiki/DmitryButskoy

rpms/pam_ssh/F-8 pam_ssh.te,NONE,1.1 pam_ssh.spec,1.13,1.14

[Patrice Dumas]

On Mon, Nov 26, 2007 at 03:20:33PM +0300, Dmitry Butskoy wrote:
>  [snip]
>
> > +%post
> > +semodule -i %{_datadir}/selinux/packages/%{name}/%{name}.pp || :
> > +
> > +%postun
> > +if [ "$1" -eq "0" ]; then
> > +  semodule -r %{module} || :
> > +fi
> >   
>
>  AFAIK a lot of people just do not use SELinux and even prefer to remove its 
>  packages. It seems to me that a hard requirement of "policycoreutils" is 
>  not a good thing here.
>
>  Maybe just check in %post and %postun whether the "semodule" binary is 
>  present (i.e., "[ -x /usr/sbin/semodule ] && ....")?  Or use %triggerin
> for 
>  policycoreutils... 
%triggerin should really be avoided. What would be nice would be to
have something similar with icons post scripts. But it isn't obvious
that selinux can do all the modules handling at any point.

In any case selinux handling should be in
http://fedoraproject.org/wiki/Packaging/ScriptletSnippets
done by selinux people with the packaging commitee control.

Certainly a task for FESCo to drive such guideline.
I'll try to remember it for the next meeting.

--
Pat

rpms/pam_ssh/F-8 pam_ssh.te,NONE,1.1 pam_ssh.spec,1.13,1.14

[Dmitry Butskoy]

Patrice Dumas wrote:
>  On Mon, Nov 26, 2007 at 03:20:33PM +0300, Dmitry Butskoy wrote:
> >
> > Maybe just check in %post and %postun whether the "semodule" binary is 
> > present (i.e., "[ -x /usr/sbin/semodule ] && ....")?  Or use
> %triggerin for 
> > policycoreutils...
> >     
>
>  %triggerin should really be avoided. 
But if the user will decide to use SELinux (install all needed packages) 
later? Then it should re-install pam_ssh to activate its policies...


Dmitry

rpms/pam_ssh/F-8 pam_ssh.te,NONE,1.1 pam_ssh.spec,1.13,1.14

[Jeremy Katz]

On Mon, 2007-11-26 at 16:54 +0300, Dmitry Butskoy wrote:
>  Patrice Dumas wrote:
>  > On Mon, Nov 26, 2007 at 03:20:33PM +0300, Dmitry Butskoy wrote:
>  >>
>  >> Maybe just check in %post and %postun whether the "semodule" binary is
>
>  >> present (i.e., "[ -x /usr/sbin/semodule ] && ....")?  Or use
> %triggerin for 
>  >> policycoreutils...
>  >>     
>  >
>  > %triggerin should really be avoided.
>  
>  But if the user will decide to use SELinux (install all needed packages) 
>  later? Then it should re-install pam_ssh to activate its policies... 
This is one of the (many) reasons why it's currently better to get
policy into the main selinux-policy package rather than trying to do
hacks to carry policy in the package.

It'd be really nice if we could get to where policy was able to be
cleanly carried within packages :-/

Jeremy

rpms/pam_ssh/F-8 pam_ssh.te,NONE,1.1 pam_ssh.spec,1.13,1.14

[Martin Ebourne]

On Mon, 26 Nov 2007 10:27:30 -0500, Jeremy Katz wrote:
>  On Mon, 2007-11-26 at 16:54 +0300, Dmitry Butskoy wrote:
> > But if the user will decide to use SELinux (install all needed
> > packages) later? Then it should re-install pam_ssh to activate its
> > policies...
>  
>  This is one of the (many) reasons why it's currently better to get
>  policy into the main selinux-policy package rather than trying to do
>  hacks to carry policy in the package. 
This is bad. It's clearly not workable to have all policy in the one 
centrally maintained cathedral-like package. It's important to be allow 
packages to have their own specific policy and we should be trying to fix 
anything that prevents this.

In this case for instance it is necessary to grant pam extra permissions 
which are not needed except for pam_ssh. Of course, good security policy 
is always to give least permissions and that is being violated here for 
everyone who doesn't use pam_ssh.

In the absence of an ability for selinux to know if pam_ssh is configured 
then at least having the policy in the module would only activate it if 
pam_ssh was installed.

Cheers,

Martin.

rpms/pam_ssh/F-8 pam_ssh.te,NONE,1.1 pam_ssh.spec,1.13,1.14

[Steve Grubb]

On Tuesday 27 November 2007 16:27:25 Martin Ebourne wrote:
>  In the absence of an ability for selinux to know if pam_ssh is
> configured
>  then at least having the policy in the module would only activate it if
>  pam_ssh was installed. 
This is why we have selinux booleans. Its to swing permissions in and out 
depending on what's installed.

-Steve

rpms/pam_ssh/F-8 pam_ssh.te,NONE,1.1 pam_ssh.spec,1.13,1.14

[Martin Ebourne]

On Tue, 27 Nov 2007 17:05:54 -0500, Steve Grubb wrote:
>  On Tuesday 27 November 2007 16:27:25 Martin Ebourne wrote:
> > In the absence of an ability for selinux to know if pam_ssh is
> > configured then at least having the policy in the module would only
> > activate it if pam_ssh was installed.
>  
>  This is why we have selinux booleans. Its to swing permissions in and
>  out depending on what's installed. 
Booleans should be for policy decisions the administrator needs to make. 
(eg. allow users to run servers that listen on tcp ports)

Having a boolean to enable use of a package you've already installed is 
the wrong use.

Cheers,

Martin.

rpms/pam_ssh/F-8 pam_ssh.te,NONE,1.1 pam_ssh.spec,1.13,1.14

[Rex Dieter]

Patrice Dumas wrote:

>  On Mon, Nov 26, 2007 at 03:20:33PM +0300, Dmitry Butskoy wrote:
> > [snip]
> >
> >> +%post
> >> +semodule -i %{_datadir}/selinux/packages/%{name}/%{name}.pp || :
> >> +
> >> +%postun
> >> +if [ "$1" -eq "0" ]; then
> >> +  semodule -r %{module} || :
> >> +fi
> >>   
> >
> > AFAIK a lot of people just do not use SELinux and even prefer to remove
> > its packages. It seems to me that a hard requirement of "policycoreutils"
> > is not a good thing here. 
other than a few MB's, it's mostly harmless.  *shrug*.

> > Maybe just check in %post and %postun whether the
> "semodule" binary is
> > present (i.e., "[ -x /usr/sbin/semodule ] && ....")?  Or use
> %triggerin
> > for policycoreutils...
>  
>  %triggerin should really be avoided. 
Why? it would appear that it would work to satisfy the requirements here.

-- Rex