Dan Walsh wrote: >Bob Gustafson wrote: > >> To me, there is a lot of confusion in the naming and choice of values >> of the SELINUX booleans. (Maybe I just don't have my head around the >> concepts.. - but I don't think I am alone) >> >> For example: >> >> The variable 'SELINUX' in the file /etc/selinux/config has the value >> choices 'enforcing' or 'permissive'. >> >Case does not matter. Which case? The variable name, or its values - 'SELINUX' or 'disabled' > >> The variable 'enforce' in the /boot/grub/grub.conf file has the value >> choices '=0' or '=1' >> >> The variable shown by the command 'getenforce' is either 'Permissive' >> or 'Enforcing' (note the initial capitalization) >> >> When using the runtime command 'setenforce', the argument is either >> '0' or '1' >> >> When using the script command 'selinuxenabled', the result is '0' if >> it IS enabled. >> >> Suggestions >> >> The variable 'SELINUX' is either 'enabled' or 'disabled' >> >> The variable 'enforcing' is either 'enabled' or 'disabled' > >This is not a bad idea, since this is the way we have gone with the >system-config-securitylevel >Check it out. Yes, system-config-securitylevel looks good. Binary choices for both SELinux and Enforcing. And a pop-up menu for 'Policy Type' choices. (This label is not the same as the variable name in the /etc/sysconfig/selinux file though. SELINUXTYPE does not even include the word 'policy') Now if only the /etc/sysconfig/selinux file could be brought into conformance. It currenly has a strange trinary choice which includes the value 'enforcing' - which is a variable name in all the other contexts. The variable name SELINUXTYPE refers to the type of policy. The word policy should be in that variable name. Maybe 'POLICY_TYPE', or 'PolicyType', or ..'SELINUXPOLICYTYPE'. Also, the names of the commands 'getenforce' and 'setenforce' should conform to the name of the variable (variable name now is 'enforcing'). Maybe just change the name of the commands to 'getenforcing' and 'setenforcing'. The boot grub.conf parameters should also have the same spelling - either 'enforce' or 'enforcing', make a consistent choice. Also, the output value of the 'selinuxenabled' command should be '0' = disabled, and '1' enabled - to conform with the grub.conf values of selinux (currently the opposite !!). This is just a plea from the 'user' side for CONSISTENCY throughout. > >> >> (This can be named 'enforce' rather than 'enforcing' - would help when >> trying to remember whether the runtime command is 'setenforce' or >> 'setenforcing') >> >> The variable 'SELINUXTYPE' is 'strict', 'targeted', 'myownpolicy', >> 'strangleddaemons', etc. >> >> -- >> fedora-selinux-list mailing list >> fedora-selinux-list@xxxxxxxxxx >> http://www.redhat.com/mailman/listinfo/fedora-selinux-list > > >-- >fedora-selinux-list mailing list >fedora-selinux-list@xxxxxxxxxx >http://www.redhat.com/mailman/listinfo/fedora-selinux-list
