Paul Moore wrote:
On Thursday 09 July 2009 05:13:20 pm Chad Sellers wrote:
On 7/9/09 4:48 PM, "Daniel J Walsh"<dwalsh@xxxxxxxxxx> wrote:
<snip>
A couple of other problems with including policy with each rpm. How do
you handle different packaging. MLS, Targeted, minimal.
That is a problem we'll have to solve, but I don't think it will be too
difficult. We could easily provide an option to the %policy directive that
could direct rpm to use a particular policy store.
Would that mean we could end up in a situation where a RPM only installs
policy modules for a particular policy type, e.g. apache only installs a
targeted policy module? That seems like it could lead to real problems down
the line as individual RPMs get this wrong. Also, what happens at the unknown
point in the future when we change from targeted as the de-facto default to
some other name?
I think if you don't list a store name explicitly it goes to default, I suspect
that will be used in most cases. Regardless of this work we need some standard
store names because otherwise instructions and blog entries and wherever else
people get information about installing minimal or mls policies will be wrong.
I like what you are trying to do here, it just scares me a little bit thinking
about all the details (and I'm sure I'm only thinking about a small number of
them too).
There are devils in the details for sure, we are just talking first steps for now.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
