On Tue, 2009-10-27 at 09:49 +0100, Dominick Grift wrote: > On Mon, 2009-10-26 at 21:16 -0400, Hasan Rezaul-CHR010 wrote: > > Hi All, > > > > I used to have the following SELinux related package versions on my > > Linux (2.6.18) system: [...] > > And I used a 'strict' Base policy from Fedora Core 6. Made the > > modifications I needed on top of that, and I was very happy... > > > > > > We get our OS packaged/delivered from a third party company, and we're > > upgrading to Linux 2.6.27, and as part of this upgrade, we are also > > migrating to much newer versions of the SELinux packages. They are: [...] > > My questions are: > > > > 1. I believe the "strict" policy is no longer supported in the above > > versions of SELinux packages? Is this true ? > > the "strict" policy model is no longer supported. The strict and target > policy have merged to a policy model that is called "targeted". No, it doesn't have a specific name. However, for ease of discussion, a system with all confined domains is still referred to as "strict", otherwise its "targeted". > > 2. The entire set of policies that I have fine-tuned over the years > > under my /etc/selinux/strict/modules/active/modules/*.pp directory in > > my previous older system, can I make any use of that ?? In other words, > > can that stuff be re-used at all ? Or do I need to develop policy from > > scratch again ? > > I am not sure about this but my opinion is that it should in most cases > be possible to use older binary modules in newer policy. Reference > policy should be compatible in my view. We try hard to maintain compatibility, but FC6 is several years old, so compatibility may have been broken, especially after the 2.x API break for UBAC. -- Chris PeBenito Tresys Technology, LLC (410) 290-1411 x150 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
