Fedora SELinux FAQ

[Karsten Wade]

These last two weeks I've been working on the SELinux pieces of the
Fedora Core 2 test2 release notes.  The current incarnation is available
at:

http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en/
http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en.xml

As described below, this content will start to be released Real Soon
Now(TM), and I am interested in your input.  Consider content quality
(clarity, ease of use, clear to non-native English readers), ability to
translate well, and of course the XML.  In addition, I want to add this
to CVS soonest, therefore I'll need Tammy's input.

Also, I just noticed that the XSL does not create a question ToC, as it
does in the DSSSL Tammy wrote for the Red Hat docs.  Is a bugzilla
report against the fedora.xsl a good way to make a feature request such
as this?  I'm not feeling clued enough to tackle it myself, yet.

If you want the whole story for the SELinux FAQ, here's a picture of the
plans and challenges:

The Plan ::

The SELinux release notes are in a FAQ.  Ed Bailey will take the
<sect1> from me, confirm it will work within the release notes
limitations, and insert that into the release notes XML.

Following release, we will fork the SELinux FAQ into a standalone FAQ. 
This will be kept for the short term in a very easy to read and write
format, such as a plain text file.  Fedora SELinux developers will be
writing to this FAQ often, to help handle bug reports and questions
following the test2 release.

After the FAQ has settled into a new shape, I will take it from the
developers, massage it back into DocBook XML, and move it to the
fedora-docs module in CVS permanently.  I'd like to create the module
in CVS right now mainly to put my work under source control, and to make
it easy for me to add in the updates after I get the FAQ back.

All the details haven't been worked out yet in terms of where the
interim FAQ will live, and where the permanent FAQ will be accessible
via URL.

The Challenges ::

I'm doing the FAQ using a <qandaset>.  The downside is the need for
keeping the XML simple for the release notes.  The release notes need to
be viewable in Anaconda using /usr/lib/anaconda/htmlbuffer.py, which
currently is limited in its ability to handle nested lists and tables. 
The FAQ portion is built using a table, but it breaks reasonably
gracefully.

For a snapshot to be used in the release notes, I may do some magic to
make them ready for the release notes.  Ed suggested a <variablelist>
setup, which is a fairly good method.

I'm keeping the main source in the more useful <qandaset> because the
canonical source will be the Fedora Core SELinux FAQ
(fedora-docs/selinux-faq), so will take full advantage of DocBook.  I'll
have to do any number of manual exports from that for various purposes,
but I think the extra work is worth having a canonical FAQ.

- Karsten
-- 
Karsten Wade
this is not the .signature you are looking for
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41

[Paul Nasrat]

On Mon, Mar 15, 2004 at 05:36:06PM -0800, Karsten Wade wrote:
>  These last two weeks I've been working on the SELinux pieces of
> the
>  Fedora Core 2 test2 release notes.  The current incarnation is available
>  at:
>  
>  http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en/
>  http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en.xml 

>  
>  As described below, this content will start to be released Real Soon
>  Now(TM), and I am interested in your input.  Consider content quality
>  (clarity, ease of use, clear to non-native English readers), ability to
>  translate well, and of course the XML.  In addition, I want to add this
>  to CVS soonest, therefore I'll need Tammy's input. 
OK - you don't mention some things which might get people:

1) Setting up an administrative user as sysadm_r
2) role identification (id/id -Z)
3) identifying context a process is running using ps --context (useful for debugging)
4) using run_init to start init scripts
5) context transition using newrole, sudo -r 
6) rpm --filecontext /--recontext queries
7) userhelper/consolehelper will prompt for own password

Paul

[Karsten Wade]

On Mon, 2004-03-15 at 23:35, Paul Nasrat wrote:

>  OK - you don't mention some things which might get people:
>  
>  1) Setting up an administrative user as sysadm_r 
This is standard SELinux setup, right?  I'm trying not to recreate for
the release notes what can be found in other HOWTOs (dictates of time). 
Still, this is a good addition for the general FAQ.

>  2) role identification (id/id -Z) 
Coincidentally, I just added that (along with ls -alZ).

>  3) identifying context a process is running using ps --context
> (useful for debugging) 
Same, using 'ps -eZ'

>  4) using run_init to start init scripts
>  5) context transition using newrole, sudo -r  
Same as first comment above.

>  6) rpm --filecontext /--recontext queries 
Ah, good call.

>  7) userhelper/consolehelper will prompt for own password 
Oh, I haven't thought about those.  I'll look into it.

thx - Karsten
-- 
Karsten Wade
this is not the .signature you are looking for
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41

[Karsten Wade]

On Tue, 2004-03-16 at 03:38, Karsten Wade wrote:
>  On Mon, 2004-03-15 at 23:35, Paul Nasrat wrote:
>  
>  > OK - you don't mention some things which might get people:
>  > 
>  > 1) Setting up an administrative user as sysadm_r
>  
>  This is standard SELinux setup, right?  I'm trying not to recreate for
>  the release notes what can be found in other HOWTOs (dictates of time). 
>  Still, this is a good addition for the general FAQ. 
I was wrong, we are going to need to cover this in the FAQ.  Why does
scope always inflate instead of deflate?

- Karsten
-- 
Karsten Wade
this is not the .signature you are looking for
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41

[Tammy Fox]

On Mon, 2004-03-15 at 20:36, Karsten Wade wrote:
>  These last two weeks I've been working on the SELinux pieces of
> the
>  Fedora Core 2 test2 release notes.  The current incarnation is available
>  at:
>  
>  http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en/
>  http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en.xml
>  
>  As described below, this content will start to be released Real Soon
>  Now(TM), and I am interested in your input.  Consider content quality
>  (clarity, ease of use, clear to non-native English readers), ability to
>  translate well, and of course the XML.  In addition, I want to add this
>  to CVS soonest, therefore I'll need Tammy's input.
>   
Sure. Just let me know when are you are reading to add it to CVS.

>  Also, I just noticed that the XSL does not create a question ToC, as
> it
>  does in the DSSSL Tammy wrote for the Red Hat docs.  Is a bugzilla
>  report against the fedora.xsl a good way to make a feature request such
>  as this?  I'm not feeling clued enough to tackle it myself, yet.
>   
Yes. If you file it in Bugzilla, I'll have a record of your request and
get to it as soon as I find time.

>  If you want the whole story for the SELinux FAQ, here's a picture
> of the
>  plans and challenges:
>  
>  The Plan ::
>  
>  The SELinux release notes are in a FAQ.  Ed Bailey will take the
>  <sect1> from me, confirm it will work within the release notes
>  limitations, and insert that into the release notes XML.
>  
>  Following release, we will fork the SELinux FAQ into a standalone FAQ. 
>  This will be kept for the short term in a very easy to read and write
>  format, such as a plain text file.  Fedora SELinux developers will be
>  writing to this FAQ often, to help handle bug reports and questions
>  following the test2 release.
>  
>  After the FAQ has settled into a new shape, I will take it from the
>  developers, massage it back into DocBook XML, and move it to the
>  fedora-docs module in CVS permanently.  I'd like to create the module
>  in CVS right now mainly to put my work under source control, and to make
>  it easy for me to add in the updates after I get the FAQ back.
>  
>  All the details haven't been worked out yet in terms of where the
>  interim FAQ will live, and where the permanent FAQ will be accessible
>  via URL.
>  
>  The Challenges ::
>  
>  I'm doing the FAQ using a <qandaset>.  The downside is the need for
>  keeping the XML simple for the release notes.  The release notes need to
>  be viewable in Anaconda using /usr/lib/anaconda/htmlbuffer.py, which
>  currently is limited in its ability to handle nested lists and tables. 
>  The FAQ portion is built using a table, but it breaks reasonably
>  gracefully.
>  
>  For a snapshot to be used in the release notes, I may do some magic to
>  make them ready for the release notes.  Ed suggested a <variablelist>
>  setup, which is a fairly good method.
>  
>  I'm keeping the main source in the more useful <qandaset> because the
>  canonical source will be the Fedora Core SELinux FAQ
>  (fedora-docs/selinux-faq), so will take full advantage of DocBook.  I'll
>  have to do any number of manual exports from that for various purposes,
>  but I think the extra work is worth having a canonical FAQ.
>  
>  - Karsten
>  -- 
>  Karsten Wade
>  this is not the .signature you are looking for
>  http://people.redhat.com/kwade/
>  gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41

[Karsten Wade]

On Tue, 2004-03-16 at 08:03, Tammy Fox wrote:

>  Sure. Just let me know when are you are reading to add it to CVS.
I held off making additions for a few days (made finishing the relnotes
for FC2test2 smoother), and I'm doing updates today.

Tammy, can you put these files in fedora-docs/selinux-faq/ for me, and
make sure I have write access?  I haven't experimented with that yet.

http://people.redhat.com/kwade/selinux/selinux-faq/Makefile
http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en.xml

Thanks everyone who has made suggestions this week, you'll see those
uploaded RSN.

For the time being, I'm keeping the FAQ on my people.redhat.com page. 
After test2 and the SELinux complications have had some time to settle
down, we'll discuss moving it to fedora.redhat.com/docs (?).

- Karsten
-- 
Karsten Wade
this is not the .signature you are looking for
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41

[Karsten Wade]

On Fri, 2004-03-19 at 13:44, Karsten Wade wrote:

>  http://people.redhat.com/kwade/selinux/selinux-faq/Makefile
>  http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en.xml 
I just updated the parent XML to be proper against the FDP standard
template.

It doesn't really matter which one you grab as the initial check-in for
CVS, I'll apply my changes the first time in one single check-in.  Makes
sense?

Thanks - Karsten
-- 
Karsten Wade
this is not the .signature you are looking for
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41

[Tammy Fox]

Karsten,

These have been committed to CVS. Let me know if you want me to post it
on fedora.redhat.com/docs/.

Tammy

On Fri, 2004-03-19 at 17:36, Karsten Wade wrote:
>  On Fri, 2004-03-19 at 13:44, Karsten Wade wrote:
>  
>  > http://people.redhat.com/kwade/selinux/selinux-faq/Makefile
>  > http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en.xml
>  
>  I just updated the parent XML to be proper against the FDP standard
>  template.
>  
>  It doesn't really matter which one you grab as the initial check-in for
>  CVS, I'll apply my changes the first time in one single check-in.  Makes
>  sense?
>  
>  Thanks - Karsten
>  -- 
>  Karsten Wade
>  this is not the .signature you are looking for
>  http://people.redhat.com/kwade/
>  gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41

[Karsten Wade]

On Mon, 2004-03-22 at 07:33, Tammy Fox wrote:
>  Karsten,
>  
>  These have been committed to CVS. Let me know if you want me to post it
>  on fedora.redhat.com/docs/. 
Stellar, thanks!  I'll be updating everything later this week in
anticipation of FC2test2 on Monday.

- Karsten

>  
>  Tammy
>  
>  On Fri, 2004-03-19 at 17:36, Karsten Wade wrote:
>  > On Fri, 2004-03-19 at 13:44, Karsten Wade wrote:
>  > 
>  > > http://people.redhat.com/kwade/selinux/selinux-faq/Makefile
>  > > http://people.redhat.com/kwade/selinux/selinux-faq/selinux-faq-en.xml
>  > 
>  > I just updated the parent XML to be proper against the FDP standard
>  > template.
>  > 
>  > It doesn't really matter which one you grab as the initial check-in for
>  > CVS, I'll apply my changes the first time in one single check-in.  Makes
>  > sense?
>  > 
>  > Thanks - Karsten
>  > -- 
>  > Karsten Wade
>  > this is not the .signature you are looking for
>  > http://people.redhat.com/kwade/
>  > gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41 
-- 
Karsten Wade
this is not the .signature you are looking for
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41