Re: .te files in packages

[Shahms King]

(I just subscribed, so I'm replying from the list archive...)

Given that FC2 is no longer shipping with SELinux enabled by default, it
makes sense to have a separate policy package for individual packages,
IMHO.  The policy package would depend on policy-sources and the parent
package and could easily do:

%post
cd /etc/security/selinux/src/polixy
make load

PACKAGELIST="parent-package parent-package-devel"

for PACKAGE in $PACKAGELIST; do
  if /bin/rpm -q $PACKAGE > /dev/null 2>&1; then
    /bin/rpm -ql $PACKAGE | /usr/sbin/setfiles -s \
                            /etc/security/selinux/file_contexts
  fi
done
================================================================

Of course all of this would be greatly enhanced by an rpm macro that
handled adding all other packages built from the same spec file as the
policy package.  Heck, the macro could have options to exclude packages
or include separately compiled packages in the list.
-- 
Shahms King <shahms(a)shahms.com&gt;

.te files in packages

[Andrew Farris]

On Wed, 2004-04-21 at 11:00 -0700, Shahms King wrote:
>  (I just subscribed, so I'm replying from the list archive...)
>  
>  Given that FC2 is no longer shipping with SELinux enabled by default, it
>  makes sense to have a separate policy package for individual packages,
>  IMHO. 
While this sounds like a neat idea.. I can see problems with it being
used effectively.  What if a user has selinux disabled when they install
a number of packages, and then decide to turn it on--the packages would
have to be retrieved and installed before they could be used.  That
could be frustrating, especially for network isolated machines.

Might it be better to include the policy with the main package, to
install the policy files into the policy source, but not to rebuild or
reload the policy unless selinux was running.  As I understood..
shipping with selinux off by default would not mean the packages were
not installed at all.  If the policy will not be installed at all, and
each 'extra' package installed that contained policy abstained from
installing the policy, then some mechanism would be required to extract
all the policy from 'extra' installed packages at the time selinux was
installed or enabled (in the future).  That would be difficult as well,
so including the policy files may not be a perfect solution either.
-- 
Andrew Farris, CPE senior (California Polytechnic State University, SLO)
fedora(a)andrewfarris.com :: lmorgul on irc.freenode.net
"The only thing necessary for the triumph of evil is for good men
to do nothing." (Edmond Burke)

.te files in packages

[Russell Coker]

On Mon, 26 Apr 2004 17:55, Andrew Farris <fedora(a)andrewfarris.com&gt; wrote:
>  On Wed, 2004-04-21 at 11:00 -0700, Shahms King wrote:
>  > (I just subscribed, so I'm replying from the list archive...)
>  >
>  > Given that FC2 is no longer shipping with SELinux enabled by default, it
>  > makes sense to have a separate policy package for individual packages,
>  > IMHO.
>
>  While this sounds like a neat idea.. I can see problems with it being
>  used effectively.  What if a user has selinux disabled when they install
>  a number of packages, and then decide to turn it on--the packages would
>  have to be retrieved and installed before they could be used.  That
>  could be frustrating, especially for network isolated machines. 
The obvious solution to this is that policy files would be kept on the system 
regardless of whether SE Linux was active at installation time or not.  
Policy files are quite small...

>  Might it be better to include the policy with the main package, to
>  install the policy files into the policy source, but not to rebuild or
>  reload the policy unless selinux was running.  As I understood.. 
Having the policy files for as many applications as possible in the 
policy-source package is good.  However we expect that our customers will 
want to build their own rpms of in-house software and that some vendors will 
want to produce rpms of proprietary software with SE Linux support.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page