SELinux permissive domains in non-Fedora tree

[Ted Rule]

I was much cheered last year to see Dan's permissive domains feature
make it into the Fedora Policy, as per his livejournal article:

   http://danwalsh.livejournal.com/24537.html

I had rather rashly hoped that this would make it into the main RedHat
tree quite quickly as it seems so very useful for testing new applications.

Sadly, it doesn't appear to exist in one of my CentOS5.3 instances
running these versions - at least "semanage --help" suggests that it's
not there, and I'm assuming
that CentOS5.3 is near enough in policy version to RHEL5 to show that
RHEL5 lacks the feature:

$ rpm -q policycoreutils selinux-policy-targeted kernel
policycoreutils-1.33.12-14.2.el5
selinux-policy-targeted-2.4.6-203.el5
kernel-2.6.18-92.el5
kernel-2.6.18-128.1.10.el5

but of course it does exist in my F10 instance running these:

$ rpm -q policycoreutils selinux-policy-targeted kernel
policycoreutils-2.0.57-14.fc10.i386
selinux-policy-targeted-3.5.13-38.fc10.noarch
kernel-2.6.27.9-159.fc10.i686


Is there a timescale for adding this feature to RHEL5, or will it have
to wait until RHEL6? Is there some sort of workaround to run the F10 policy
on a CentOS5 box to get the feature, or does that simply involve so many
version changes to umpteen other packages as to be a fruitless exercise?



-- 
Ted Rule

Director, Layer3 Systems Ltd

http://www.layer3.co.uk/