policy packages

[Gene Czarcinski]

I noticed that there is a new policy package in development 
(policy-strict-sources) to make a total of three (policy, policy-sources, and 
policy-strict-sources).

How do the three packages relate to the old two package situation?  Is 
policy-sources now more "relaxed" than previous versions?  If it is more 
"relaxed", how about policy?

Gene

[Richard Hally]

Gene Czarcinski wrote:

>  I noticed that there is a new policy package in development 
>  (policy-strict-sources) to make a total of three (policy, policy-sources, and 
>  policy-strict-sources).
>  
>  How do the three packages relate to the old two package situation?  Is 
>  policy-sources now more "relaxed" than previous versions?  If it is more 
>  "relaxed", how about policy?
>  
>  Gene
>   
Well, when I installed policy-strict-sources, it replaced the files from 
the policy-sources package. Surprise! I would have thought in would have 
installed them under /etc/security/selinux/src/policy-strict. I hope we 
will be able to have both (or more) policies sources installed at the 
same time.
If I rename src/policy to src/policy-strict can I then reinstall 
policy-sources? what rpm options should I use?
Thanks for the help
Richard Hally

[Daniel J Walsh]

Richard Hally wrote:

>  Gene Czarcinski wrote:
>
> > I noticed that there is a new policy package in development 
> > (policy-strict-sources) to make a total of three (policy, 
> > policy-sources, and policy-strict-sources).
> >
> > How do the three packages relate to the old two package situation?  
> > Is policy-sources now more "relaxed" than previous versions?  If it 
> > is more "relaxed", how about policy?
> >
> > Gene
> >
>
>  Well, when I installed policy-strict-sources, it replaced the files 
>  from the policy-sources package. Surprise! I would have thought in 
>  would have installed them under 
>  /etc/security/selinux/src/policy-strict. I hope we will be able to 
>  have both (or more) policies sources installed at the same time.
>  If I rename src/policy to src/policy-strict can I then reinstall 
>  policy-sources? what rpm options should I use?
>  Thanks for the help
>  Richard Hally 

Yes that was a mistake that it got out.  I am working on a new version 
of the policy src rpm.  It will create 4 rpms.  policy and 
policy-sources which will contain the targeted policy (relaxed) policy.  
policy-strict and policy-strict-sources which will contain the strict 
policy (The policy we currently ship).  This should be available in the 
first rawhide versions of FC3.   Policy sources will install in
/etc/security/selinux/targeted/src/policy.  Strict policy sources will 
install in /etc/security/selinux/strict/src/policy.

Dan

>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Gene Czarcinski]

On Wednesday 12 May 2004 08:16, Daniel J Walsh wrote:
>  Yes that was a mistake that it got out.  I am working on a new
> version
>  of the policy src rpm.  It will create 4 rpms.  policy and
>  policy-sources which will contain the targeted policy (relaxed) policy.  
>  policy-strict and policy-strict-sources which will contain the strict
>  policy (The policy we currently ship).  This should be available in the
>  first rawhide versions of FC3.   Policy sources will install in
>  /etc/security/selinux/targeted/src/policy.  Strict policy sources will
>  install in /etc/security/selinux/strict/src/policy. 
OK, sounds good.  Since it appears that you can install all four packages from 
your description, will you be able to select between "relaxed" (I prefer 
calling it perhaps "limited") and the "strict" policy via 
/etc/sysconfig/selinux?

Gene

[Karl MacMillan]

>  -----Original Message-----
>  >
>  > Well, when I installed policy-strict-sources, it replaced the files
>  > from the policy-sources package. Surprise! I would have thought in
>  > would have installed them under
>  > /etc/security/selinux/src/policy-strict. I hope we will be able to
>  > have both (or more) policies sources installed at the same time.
>  > If I rename src/policy to src/policy-strict can I then reinstall
>  > policy-sources? what rpm options should I use?
>  > Thanks for the help
>  > Richard Hally
>  
>  
>  Yes that was a mistake that it got out.  I am working on a new version
>  of the policy src rpm.  It will create 4 rpms.  policy and
>  policy-sources which will contain the targeted policy (relaxed) policy.
>  policy-strict and policy-strict-sources which will contain the strict
>  policy (The policy we currently ship).  This should be available in the
>  first rawhide versions of FC3.   Policy sources will install in
>  /etc/security/selinux/targeted/src/policy.  Strict policy sources will
>  install in /etc/security/selinux/strict/src/policy.
>   
Will there be any way to determine which policy is currently active? Also, I
am concerned that the well known location for the policy source
(/etc/security/selinux/src/policy/) will go away and break tools that expect
it. All of our tools are configurable, of course, but this change will make
it hard to provide good configuration defaults. What about making
/etc/security/selinux/src/policy a symlink to the currently active policy?

Karl

Karl MacMillan
Tresys Technology
http://www.tresys.com
[phone] ext 134

>  Dan
>  
>  >
>  > --
>  > fedora-selinux-list mailing list
>  > fedora-selinux-list(a)redhat.com
>  > http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Daniel J Walsh]

Karl MacMillan wrote:

> >-----Original Message-----
> >    
> >
> >>Well, when I installed policy-strict-sources, it replaced the files
> >>from the policy-sources package. Surprise! I would have thought in
> >>would have installed them under
> >>/etc/security/selinux/src/policy-strict. I hope we will be able to
> >>have both (or more) policies sources installed at the same time.
> >>If I rename src/policy to src/policy-strict can I then reinstall
> >>policy-sources? what rpm options should I use?
> >>Thanks for the help
> >>Richard Hally
> >>      
> >>
> >Yes that was a mistake that it got out.  I am working on a new version
> >of the policy src rpm.  It will create 4 rpms.  policy and
> >policy-sources which will contain the targeted policy (relaxed) policy.
> >policy-strict and policy-strict-sources which will contain the strict
> >policy (The policy we currently ship).  This should be available in the
> >first rawhide versions of FC3.   Policy sources will install in
> >/etc/security/selinux/targeted/src/policy.  Strict policy sources will
> >install in /etc/security/selinux/strict/src/policy.
> >
> >    
> >
>
> Will there be any way to determine which policy is currently active? Also, I
> am concerned that the well known location for the policy source
> (/etc/security/selinux/src/policy/) will go away and break tools that expect
> it. All of our tools are configurable, of course, but this change will make
> it hard to provide good configuration defaults. What about making
> /etc/security/selinux/src/policy a symlink to the currently active policy?
>
> Karl
>
> Karl MacMillan
> Tresys Technology
> http://www.tresys.com
> [phone] ext 134
>
>   
>
> >Dan
> >
> >    
> >
> >>--
> >>fedora-selinux-list mailing list
> >>fedora-selinux-list(a)redhat.com
> >>http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >>      
> >>
> >--
> >fedora-selinux-list mailing list
> >fedora-selinux-list(a)redhat.com
> >http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >    
> >
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   
>  
We could change a sym link.  We were thinking of using 
/etc/sysconfig/selinux to specify which policy is in use, and where the 
directories are.  Right now I am just trying to get the SRPM to build 
both policy groups.  The only tools that should be affected are those 
that deal with the src dir, which is the SEtools.

[Richard Hally]

Daniel J Walsh wrote:

>  Karl MacMillan wrote:
>  
> >> -----Original Message-----
> >>   
> >>
> >>> Well, when I installed policy-strict-sources, it replaced the files
> >>> from the policy-sources package. Surprise! I would have thought in
> >>> would have installed them under
> >>> /etc/security/selinux/src/policy-strict. I hope we will be able to
> >>> have both (or more) policies sources installed at the same time.
> >>> If I rename src/policy to src/policy-strict can I then reinstall
> >>> policy-sources? what rpm options should I use?
> >>> Thanks for the help
> >>> Richard Hally
> >>>     
> >>
> >> Yes that was a mistake that it got out.  I am working on a new version
> >> of the policy src rpm.  It will create 4 rpms.  policy and
> >> policy-sources which will contain the targeted policy (relaxed) policy.
> >> policy-strict and policy-strict-sources which will contain the strict
> >> policy (The policy we currently ship).  This should be available in the
> >> first rawhide versions of FC3.   Policy sources will install in
> >> /etc/security/selinux/targeted/src/policy.  Strict policy sources will
> >> install in /etc/security/selinux/strict/src/policy.
> >>
> >>   
> >
> >
> > Will there be any way to determine which policy is currently active? 
> > Also, I
> > am concerned that the well known location for the policy source
> > (/etc/security/selinux/src/policy/) will go away and break tools that 
> > expect
> > it. All of our tools are configurable, of course, but this change will 
> > make
> > it hard to provide good configuration defaults. What about making
> > /etc/security/selinux/src/policy a symlink to the currently active 
> > policy?
> >
> > Karl
> >
> > Karl MacMillan
> > Tresys Technology
> > http://www.tresys.com
> > [phone] ext 134
> >
> >  
> > 
> >  
> >
>  We could change a sym link.  We were thinking of using 
>  /etc/sysconfig/selinux to specify which policy is in use, and where the 
>  directories are.  Right now I am just trying to get the SRPM to build 
>  both policy groups.  The only tools that should be affected are those 
>  that deal with the src dir, which is the SEtools.
>  --  
Perhaps if you consider Karl as the upstream developer for setools and 
remember that these tools are intended to work on other distributions as 
well, it would be appropriate to not use /etc/sysconfig/selinux.
Also, consider current practice where /etc/security/selinux/src is the 
location for the policysources thus selinux/src should contain 
/src/policy-x, policy-y and policy-z with /src/policy a link to any one 
  of the policy-n directories as Karl suggested.
Using /selinux/targeted/src  and /selinux/foo/src and 
/selinux/whatever/src to contain different instances of source seems 
backward to me. (IMHO) :)
Thanks,
Richard Hally

[Karl MacMillan]

>  >> Will there be any way to determine which policy is currently
> active?
>  >> Also, I
>  >> am concerned that the well known location for the policy source
>  >> (/etc/security/selinux/src/policy/) will go away and break tools that
>  >> expect
>  >> it. All of our tools are configurable, of course, but this change will
>  >> make
>  >> it hard to provide good configuration defaults. What about making
>  >> /etc/security/selinux/src/policy a symlink to the currently active
>  >> policy?
>  >>
>  >> Karl
>  >>
>  >>
>  > We could change a sym link.  We were thinking of using
>  > /etc/sysconfig/selinux to specify which policy is in use, and where the
>  > directories are.  Right now I am just trying to get the SRPM to build
>  > both policy groups.  The only tools that should be affected are those
>  > that deal with the src dir, which is the SEtools.
>  > --
>  Perhaps if you consider Karl as the upstream developer for setools and
>  remember that these tools are intended to work on other distributions as
>  well, it would be appropriate to not use /etc/sysconfig/selinux.
>  Also, consider current practice where /etc/security/selinux/src is the
>  location for the policysources thus selinux/src should contain
>  /src/policy-x, policy-y and policy-z with /src/policy a link to any one
>    of the policy-n directories as Karl suggested.
>  Using /selinux/targeted/src  and /selinux/foo/src and
>  /selinux/whatever/src to contain different instances of source seems
>  backward to me. (IMHO) :) 
I agree with this - we need to be able to support as many distributions as
possible and the /etc/security/selinux/src/policy directory has been used
for many years as the default location for the source to the current policy
(making it an easy way for us to provide that support). I think that this
would be worthwhile to retain through symlinks. Additionally, I think it
would be better for the strict, targeted, etc sources to remain under src as
Richard suggested. When binary modules are added in
/etc/security/selinux/modules it will be clearer if all of the source is
under /etc/security/selinux/src.

Karl

Karl MacMillan
Tresys Technology
http://www.tresys.com
[phone] ext 134

>  Thanks,
>  Richard Hally
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Russell Coker]

On Thu, 13 May 2004 05:35, Richard Hally <rhally(a)mindspring.com&gt; wrote:
>  Also, consider current practice where /etc/security/selinux/src is
> the
>  location for the policysources thus selinux/src should contain
>  /src/policy-x, policy-y and policy-z with /src/policy a link to any one 
I think we should use /etc/selinux as the sym-link to the policy 
source.  /etc/security/selinux/src is too much typing when you do any serious 
policy work.

Dan, what do you think?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Karl MacMillan]

----- Original Message ----- 
From: "Russell Coker" <russell(a)coker.com.au&gt;
To: <fedora-selinux-list(a)redhat.com&gt;
Cc: "Daniel J Walsh" <dwalsh(a)redhat.com&gt;
Sent: Friday, May 14, 2004 11:01 PM
Subject: Re: policy packages


>  On Thu, 13 May 2004 05:35, Richard Hally
> <rhally(a)mindspring.com&gt; wrote:
>  > Also, consider current practice where /etc/security/selinux/src is the
>  > location for the policysources thus selinux/src should contain
>  > /src/policy-x, policy-y and policy-z with /src/policy a link to any one
>
>  I think we should use /etc/selinux as the sym-link to the policy
>  source.  /etc/security/selinux/src is too much typing when you do any 
serious
>  policy work.
>  
I am not against adding the symlink if /etc/security/selinux/src/policy
remains. Breaking that compatibility will be a  problem for us and others at
least in the short term and, if other distributions don't adopt the change,
a problem in the long term. All of our tools are easily configurable to find
the policy source wherever, but this makes it difficult to set defaults.
Also, I haven't seen what I thought was a compelling reason to break what
has been standard practice for a long time. If you do want to add a shorter
symlink, I think that it should be from /etc/security/selinux to
/etc/selinux so that in the future /etc/selinux/src and /etc/selinux/modules
can work nicely.

Karl

>  Dan, what do you think?
>
>  -- 
>  http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
>  http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
>  http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
>  http://www.coker.com.au/~russell/  My home page
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>

[Russell Coker]

On Sun, 16 May 2004 03:41, "Karl MacMillan" <kmacmillan(a)tresys.com&gt;
wrote:
>  > I think we should use /etc/selinux as the sym-link to the
> policy
>  > source.  /etc/security/selinux/src is too much typing when you do any
>  > serious policy work.
>
>  I am not against adding the symlink if /etc/security/selinux/src/policy
>  remains. Breaking that compatibility will be a  problem for us and others
>  at least in the short term and, if other distributions don't adopt the
>  change, a problem in the long term. All of our tools are easily 
If /etc/selinux is used then it's best for compatibility for everyone.

Debian has been using /usr/share/selinux/policy/current since Howard suggested 
it:
http://marc.theaimsgroup.com/?l=selinux&m=101864307520785&w=2

Gentoo apparently uses /etc/security/selinux/src/policy.  It seems that if you 
want to have cross-distribution compatibility then a /etc/selinux sym-link is 
the best possibility.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Karl MacMillan]

>  -----Original Message-----
>  From: Russell Coker [mailto:[e-mail]]
>  Sent: Saturday, May 15, 2004 4:17 PM
>  To: Karl MacMillan
>  Cc: Fedora SELinux support list for users & developers.; Daniel J Walsh
>  Subject: Re: policy packages
>  
>  On Sun, 16 May 2004 03:41, "Karl MacMillan" <kmacmillan(a)tresys.com&gt;
> wrote:
>  > > I think we should use /etc/selinux as the sym-link to the policy
>  > > source.  /etc/security/selinux/src is too much typing when you do any
>  > > serious policy work.
>  >
>  > I am not against adding the symlink if /etc/security/selinux/src/policy
>  > remains. Breaking that compatibility will be a  problem for us and
>  others
>  > at least in the short term and, if other distributions don't adopt the
>  > change, a problem in the long term. All of our tools are easily
>  
>  If /etc/selinux is used then it's best for compatibility for everyone.
>  
>  Debian has been using /usr/share/selinux/policy/current since Howard
>  suggested
>  it:
>  http://marc.theaimsgroup.com/?l=selinux&m=101864307520785&w=2
>  
>  Gentoo apparently uses /etc/security/selinux/src/policy.  It seems that if
>  you
>  want to have cross-distribution compatibility then a /etc/selinux sym-link
>  is
>  the best possibility. 
That is my goal, and I am glad that you mentioned that there are already
problems with this. It seems like we still haven't solved the problem,
though. I was after a consistent location for the currently active source
and linking /etc/selinux /etc/security/selinux doesn't address this. I
suggest that wherever the top of the selinux files is, the current policy
should be in src/policy. That way /etc/selinux/src/policy would be the
current policy source in your suggestion and the binary modules can then be
/etc/selinux/modules.

Karl


Karl MacMillan
Tresys Technology
http://www.tresys.com
[phone] ext 134

>  
>  --
>  http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
>  http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
>  http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
>  http://www.coker.com.au/~russell/  My home page

[Daniel J Walsh]

Policy rename dilemma.  I have a version of policy ready to go that 
supports both strict and targeted policy.   The version I wrote creates 
targeted policy as policy and policy-sources and the strict as 
policy-strict and policy-strict-sources.  The problem with this is that 
if I put it in Rawhide people upgrading will switch from strict policy 
to relaxed and require a relabel.  If I change it to strict equals 
policy and policy-sources, with policy-targeted and 
policy-targeted-sources, than I am stuck with that even though 
policy-targeted will be the default in FC3, which seems wrong. 

Comments?

Dan

[Jeremy Katz]

On Tue, 2004-05-18 at 23:15 -0400, Daniel J Walsh wrote:
>  Policy rename dilemma.  I have a version of policy ready to go that 
>  supports both strict and targeted policy.   The version I wrote creates 
>  targeted policy as policy and policy-sources and the strict as 
>  policy-strict and policy-strict-sources.  The problem with this is that 
>  if I put it in Rawhide people upgrading will switch from strict policy 
>  to relaxed and require a relabel.  If I change it to strict equals 
>  policy and policy-sources, with policy-targeted and 
>  policy-targeted-sources, than I am stuck with that even though 
>  policy-targeted will be the default in FC3, which seems wrong.  
You could do policy-strict Obsoletes: policy < newver.  Then if you do
an update with obsoletes/upgrade, you'll get policy-strict (and probably
newer now targeted policy too, but having that installed doesn't cause
problems) and the logic for what the various things
in /etc/sysconfig/selinux are can be basically
enabled ==> policy-strict
targeted ==> policy (the targeted version)

> From a packaging perspective, it should work.  It's still a little
confusing.  I'd actually probably change the default for strict to be
use strict instead of enabled and just have enabled for compatibility's
sake.

Jeremy

[Chip Turner]

Jeremy Katz <katzj(a)redhat.com&gt; writes:

>  On Tue, 2004-05-18 at 23:15 -0400, Daniel J Walsh wrote:
> > Policy rename dilemma.  I have a version of policy ready to go that 
> > supports both strict and targeted policy.   The version I wrote creates 
> > targeted policy as policy and policy-sources and the strict as 
> > policy-strict and policy-strict-sources.  The problem with this is that 
> > if I put it in Rawhide people upgrading will switch from strict policy 
> > to relaxed and require a relabel.  If I change it to strict equals 
> > policy and policy-sources, with policy-targeted and 
> > policy-targeted-sources, than I am stuck with that even though 
> > policy-targeted will be the default in FC3, which seems wrong. 
>
>  You could do policy-strict Obsoletes: policy < newver.  Then if you do 
I tried versioned obsoletes with some Perl packaging for a while and,
IIRC, rpm ignored the version completely.  Or maybe it was up2date
that did.  Something handled it wrong, don't recall the details but
the net result was 'doctor, it hurts when I do this. 'don't do that.'
It may be fixed now, but this wasn't too far back.

Chip

-- 
Chip Turner                   cturner(a)redhat.com
                              Red Hat, Inc.

[Jeremy Katz]

On Tue, 2004-05-18 at 23:38 -0400, Chip Turner wrote:
>  I tried versioned obsoletes with some Perl packaging for a while
> and,
>  IIRC, rpm ignored the version completely.  Or maybe it was up2date
>  that did.  Something handled it wrong, don't recall the details but
>  the net result was 'doctor, it hurts when I do this. 'don't do that.'
>  It may be fixed now, but this wasn't too far back. 
RPM does the right thing.  There may be tools that don't, but if that's
the case, my response is "fix the bloody tool".  Avoiding it just means
that it'll never get fixed :)

Jeremy

FC2test3 and final release

[Pratik Mehta]

hi,

 is there a difference between the two releases:
FC2 Test 3 and the Final fedora release, as far as SELinux goes.

- Pratik

PS: sorry message is in html, will need to fix this mail app.

FC2test3 and final release

[Stephen Smalley]

On Fri, 2004-05-21 at 01:30, Pratik Mehta wrote:
>   is there a difference between the two releases:
>  FC2 Test 3 and the Final fedora release, as far as SELinux goes. 
Yes, there have certainly been changes to SELinux-related packages since
test3.  But if you have been updating from the devel tree, you should be
up-to-date.  Note that even if you have installed FC2/final, there are
newer packages in the devel tree relevant to SELinux, including
SELinux-related changes to the kernel as well as updates to policy and
the like.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Richard Hally]

Daniel J Walsh wrote:
>  Policy rename dilemma.  I have a version of policy ready to go that 
>  supports both strict and targeted policy.   The version I wrote creates 
>  targeted policy as policy and policy-sources and the strict as 
>  policy-strict and policy-strict-sources.  The problem with this is that 
>  if I put it in Rawhide people upgrading will switch from strict policy 
>  to relaxed and require a relabel.  If I change it to strict equals 
>  policy and policy-sources, with policy-targeted and 
>  policy-targeted-sources, than I am stuck with that even though 
>  policy-targeted will be the default in FC3, which seems wrong.
>  Comments?
>  
>  Dan
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   
If "targeted" will be the default going forward, it seems that the thing

to do is make the change now. A one time relabel at this stage is not as 
bad as having to make a switch later.
For those that want the "strict" , they can set up the links the way 
they prefer after the update.
Is the "strict" policy close to what is now in place?

Richard Hally

[Daniel J Walsh]

Richard Hally wrote:

>  Daniel J Walsh wrote:
>
> > Policy rename dilemma.  I have a version of policy ready to go that 
> > supports both strict and targeted policy.   The version I wrote 
> > creates targeted policy as policy and policy-sources and the strict 
> > as policy-strict and policy-strict-sources.  The problem with this is 
> > that if I put it in Rawhide people upgrading will switch from strict 
> > policy to relaxed and require a relabel.  If I change it to strict 
> > equals policy and policy-sources, with policy-targeted and 
> > policy-targeted-sources, than I am stuck with that even though 
> > policy-targeted will be the default in FC3, which seems wrong.
> > Comments?
> >
> > Dan
> > -- 
> > fedora-selinux-list mailing list
> > fedora-selinux-list(a)redhat.com
> > http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >
>  If "targeted" will be the default going forward, it seems that the 
>  thing to do is make the change now. A one time relabel at this stage 
>  is not as bad as having to make a switch later.
>  For those that want the "strict" , they can set up the links the way 
>  they prefer after the update.
>  Is the "strict" policy close to what is now in place? 
Strict is the current policy with several fixes.

Dan

>  Richard Hally
>
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[lonely wolf]

Daniel J Walsh wrote:

>  Policy rename dilemma.  I have a version of policy ready to go that 
>  supports both strict and targeted policy.   The version I wrote 
>  creates targeted policy as policy and policy-sources and the strict as 
>  policy-strict and policy-strict-sources.  The problem with this is 
>  that if I put it in Rawhide people upgrading will switch from strict 
>  policy to relaxed and require a relabel.  If I change it to strict 
>  equals policy and policy-sources, with policy-targeted and 
>  policy-targeted-sources, than I am stuck with that even though 
>  policy-targeted will be the default in FC3, which seems wrong.
>  Comments? 
%pre
echo make sure to relabel ....


-- 
My mechanic told me, "I couldn't repair your brakes, so I made your horn
louder."