Currently when rpm ships, it does an semodule -b base.pp -i a.pp b,pp c.pp It should be able to do semodule -b base.pp -u a.pp b.pp c.pp But -u blows up if c.pp was not previously installed. It should follow the rpm -U syntax; upgrade if the previous package exists and install if it does not. If we want to add a -F (freshen) this could only upgrade pre-existing modules, and ignore others. If I was to change to -u, I would need to add a fourth field to policy modules and upgrade it each time I added a patch. It would be a pain, but I guess I could deal with it. BUT A bigger problem is how to deal with an administrator that wants to remove a package and ensure it does not get reinstalled. If an administrator decides he does not want to install unconfined.pp, we do not want an selinux-policy upgrade to re-install the package. semodule -r should set a flag when a package gets removed. Then semodule -u or semodule -i would not install the package unless the administrator specifies a -f. semodule -r unconfined Would create a file in the policy store /etc/selinux/targeted/modules/active/modules/unconfined.exclude. semodule -u and semodule -i would respect, and just print out an error message. semodule -u unconfined.pp Warning: unconfined.pp is excluded from the policy store, use -f to force the install Add -q qualifier to quiet this message # semodule -f -u unconfined.pp Would install the package and remove the flag. I would like to get consensus on this before I implement. Or others can implement. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
