Drawing lessons from fatal SELinux bug #1054350

Kevin Kofler kevin.kofler at chello.at
Sat Jan 25 16:41:57 UTC 2014


Chris Murphy wrote:
> If there is a directory that contains update and non-update related file
> changes, that's a problem. If there's segmentation, then this can be done.
> 
> Clearly /home needs to be separate (it's OK to take a snapshot but just
> don't use it by default in a rollback) or we lose changes in /home in a
> rollback from the time of the snapshot to the time of the decision to
> rollback.
> 
> Another possible case it's /etc/ where the either a package or the user
> could make changes during the update.

There's also /root, and then the most annoying case: /var. /var/lib/rpm 
definitely needs to be rolled back, but you DON'T want to roll back things 
such as log files in /var/log or systemwide databases (other than the RPM 
database).

        Kevin Kofler



More information about the devel mailing list