Variable naming confusion

[Bob Gustafson]

To me, there is a lot of confusion in the naming and choice of values of 
the SELINUX booleans.  (Maybe I just don't have my head around the 
concepts.. - but I don't think I am alone)

For example:

The variable 'SELINUX' in the file /etc/selinux/config has the value 
choices 'enforcing' or 'permissive'.

The variable 'enforce' in the /boot/grub/grub.conf file has the value 
choices '=0' or '=1'

The variable shown by the command 'getenforce' is either 'Permissive' or 
'Enforcing' (note the initial capitalization)

When using the runtime command 'setenforce', the argument is either '0' 
or '1'

When using the script command 'selinuxenabled', the result is '0' if it 
IS enabled.

Suggestions

The variable 'SELINUX' is either 'enabled' or 'disabled'

The variable 'enforcing' is either 'enabled' or 'disabled'

(This can be named 'enforce' rather than 'enforcing' - would help when 
trying to remember whether the runtime command is 'setenforce' or 
'setenforcing')

The variable 'SELINUXTYPE' is 'strict', 'targeted',
'myownpolicy', 
'strangleddaemons', etc.

[Daniel J Walsh]

Bob Gustafson wrote:

>  To me, there is a lot of confusion in the naming and choice of values
>
>  of the SELINUX booleans.  (Maybe I just don't have my head around the 
>  concepts.. - but I don't think I am alone)
>
>  For example:
>
>  The variable 'SELINUX' in the file /etc/selinux/config has the value 
>  choices 'enforcing' or 'permissive'.
>  
Case does not matter.

>  The variable 'enforce' in the /boot/grub/grub.conf file has
> the value 
>  choices '=0' or '=1'
>
>  The variable shown by the command 'getenforce' is either 'Permissive' 
>  or 'Enforcing' (note the initial capitalization)
>
>  When using the runtime command 'setenforce', the argument is either 
>  '0' or '1'
>
>  When using the script command 'selinuxenabled', the result is '0' if 
>  it IS enabled.
>
>  Suggestions
>
>  The variable 'SELINUX' is either 'enabled' or 'disabled'
>
>  The variable 'enforcing' is either 'enabled' or 'disabled'
This is not a bad idea, since this is the way we have gone with the 
system-config-securitylevel
Check it out.

>  (This can be named 'enforce' rather than 'enforcing' - would help when 
>  trying to remember whether the runtime command is 'setenforce' or 
>  'setenforcing')
>
>  The variable 'SELINUXTYPE' is 'strict', 'targeted',
> 'myownpolicy', 
>  'strangleddaemons', etc.
>
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Bob Gustafson]

Dan Walsh wrote:
> Bob Gustafson wrote:
>
> > To me, there is a lot of confusion in the naming and choice of values
> > of the SELINUX booleans.  (Maybe I just don't have my head around the
> > concepts.. - but I don't think I am alone)
> >
> > For example:
> >
> > The variable 'SELINUX' in the file /etc/selinux/config has the value
> > choices 'enforcing' or 'permissive'.
> >
> Case does not matter. 
Which case? The variable name, or its values - 'SELINUX' or 'disabled'

> > The variable 'enforce' in the /boot/grub/grub.conf file has the value
> > choices '=0' or '=1'
> >
> > The variable shown by the command 'getenforce' is either
> 'Permissive'
> > or 'Enforcing' (note the initial capitalization)
> >
> > When using the runtime command 'setenforce', the argument is either
> > '0' or '1'
> >
> > When using the script command 'selinuxenabled', the result is '0' if
> > it IS enabled.
> >
> > Suggestions
> >
> > The variable 'SELINUX' is either 'enabled' or 'disabled'
> >
> > The variable 'enforcing' is either 'enabled' or 'disabled'
>
> This is not a bad idea, since this is the way we have gone with the
> system-config-securitylevel
> Check it out. 
Yes, system-config-securitylevel looks good. Binary choices for both
SELinux and Enforcing. And a pop-up menu for 'Policy Type' choices. (This
label is not the same as the variable name in the /etc/sysconfig/selinux
file though. SELINUXTYPE does not even include the word 'policy')

Now if only the /etc/sysconfig/selinux file could be brought into
conformance.  It currenly has a strange trinary choice which includes the
value 'enforcing' - which is a variable name in all the other contexts. The
variable name SELINUXTYPE refers to the type of policy. The word policy
should be in that variable name. Maybe 'POLICY_TYPE', or 'PolicyType', or
..'SELINUXPOLICYTYPE'.

Also, the names of the commands 'getenforce' and 'setenforce' should
conform to the name of the variable (variable name now is 'enforcing').
Maybe just change the name of the commands to 'getenforcing' and
'setenforcing'. The boot grub.conf parameters should also have the same
spelling - either 'enforce' or 'enforcing', make a consistent choice.

Also, the output value of the 'selinuxenabled' command should be '0' =
disabled, and '1' enabled - to conform with the grub.conf values of selinux
(currently the opposite !!).

This is just a plea from the 'user' side for CONSISTENCY throughout.

> >
> > (This can be named 'enforce' rather than 'enforcing' - would help
> when
> > trying to remember whether the runtime command is 'setenforce' or
> > 'setenforcing')
> >
> > The variable 'SELINUXTYPE' is 'strict', 'targeted',
> 'myownpolicy',
> > 'strangleddaemons', etc.
> >
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list(a)redhat.com
> > http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Karsten Wade]

On Mon, 2004-09-20 at 08:48, Bob Gustafson wrote:

>  This is just a plea from the 'user' side for CONSISTENCY
> throughout. 
+1  This is an agreement from the documentation side, good ideas!

- Karsten, 
  who wrote the prototype for /etc/sysconfig/selinux and 
  would love to see it revised
-- 
Karsten Wade, RHCE, Tech Writer
a lemon is just a melon in disguise
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41