selinux rant, compressed version (Was Re: kernels won't boot)

[David Zeuthen]

On Thu, 2008-01-03 at 15:48 -0500, Jesse Keating wrote:
> On Thu, 03 Jan 2008 15:43:26 -0500
> David Zeuthen <david at fubar.dk> wrote:
> 
> >    Typical responses:
> >      - "rpm cannot handle SELinux policy": <- bullshit; it's not much
> >        different from other file meta data; do we store file modes and
> >        permissions centrally too? No.
> 
> I don't know where you're getting this "typical" response from.  The
> problem isn't rpm, the problem is selinux itself, not allowing rpm to
> write out files that have a context it doesn't know about (yet), 

Also, one obvious solution here is to install the selinux policy before
files are copied; much like you create a daemon user in %pre. Or if %pre
isn't early enough, invent another tag or whatever. Point is: you can't
entirely blame this on the SELinux people; getting things like rpm to
work with selinux actually requires a two-way conversation - something
that some companies can't figure out to make happen :-/

       David