On Thu, 2012-02-09 at 08:55 -0500, Stephen Smalley wrote:
> On Wed, 2012-02-08 at 13:32 -0800, C.J. Adams-Collier KF7BMP wrote:
> > Okay. Do these ever get purged under any other circumstances? I noted
> > that when I booted without selinux enabled and then with it enabled, the
> > filesystem was re-labeled. Does anything else get triggered in this
> > situation? Specifically, do policies get removed?
>
> No.
>
> > It looks like the alsa.pp is failing, so my working and slightly
> > modified command was:
>
> That's interesting, and it might explain why your policy didn't get
> fully installed originally. Is that alsa.pp file from the current
> selinux-policy package or is it a leftover of an older one? What is the
> error you get with it? It should be removed if it doesn't work.
cjac@foxtrot:~$ locate alsa.pp | xargs dpkg -S | awk -F: '{print $1}' | xargs debsums | grep alsa.pp
/usr/share/selinux/default/alsa.pp OK
cjac@foxtrot:~$
How do I check for an error. Not on STDOUT or STDERR it seems... This
may be one of the strangest, least useful error message I've ever seen.
But it's got stiff competition.
cjac@foxtrot:~$ locate alsa.pp | xargs dpkg -S | awk -F: '{print $1}' | xargs debsums | grep alsa.pp | sudo xargs semodule -i
semodule: Failed on OK!
> > $ pushd /usr/share/selinux/default
> > $ time sudo \
> > semodule -i `ls *.pp | grep -v -e 'base.pp' -e 'alsa.pp'`
> >
> > real 0m24.148s
> > user 0m23.249s
> > sys 0m0.628s
> >
> > This seems like it would take slightly less time than piping the output
> > of ls to xargs, since it only runs semodule once.
> >
> > $ time ls *.pp | grep -v -e 'base.pp' -e 'alsa.pp' | \
> > xargs sudo semodule -b base.pp -i
> >
> > real 0m25.659s
> > user 0m24.778s
> > sys 0m0.660s
> >
> > But they both get the job done and the difference in run time is very
> > small.
Yep. Might be a potential indicator for performance improvement,
however.
> Feel free to submit a patch for the EXAMPLES section in the semodule man
> page. Even better would be to improve semodule so that it automatically
> detects the base module and handles it so that you can just do semodule
> -i *.pp in all cases and not have to worry about filtering the list and
> handling base specially.
sounds reasonable. git uri anyone?
Attachment:
signature.asc
Description: This is a digitally signed message part
