Re: Determining if SELinux is installed

[Scott Cain <cain@cshl.org>]

On Tue, 2005-02-15 at 12:13 -0500, Daniel J Walsh wrote:
> >
> Why can't you fully path it?  Just checking if the /proc/filesystem 
> exists is not sufficient, if the user has disabled
> SELinux via /etc/selinux/config instead of selinux=0, I think.  
> selinuxenabled also checks to see if a policy has been
> loaded.
> 
> I would do the equivalent of
> 
> [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled
> 
> in perl.
> 
> 
> Dan
Hi Dan,

I don't particularly like giving the full path to something for exactly
a reason that Stephen gave: it used to be in /usr/bin, now it's
in /usr/sbin, next, some genius will move it to /usr/libexec (or similar
foolishness).  If I can't count on it being in the users path, I don't
want it.  Otherwise, I'll always have a potential failure point if
selinuxenabled is moved in some other distro.

Also, at the moment, the installer isn't going to do anything tricky.
If it detects that SELinux is installed (or might be), it will die with
a warning message telling the user what to do.  To get past that point,
the user will have to pass in a flag on the command line telling the
installer that all is well.

The "what to do" at this point is: make sure the policies are up to
date, and then disable everything for httpd, or run in permissive mode,
or disable it altogether.

Scott

-- 
------------------------------------------------------------------------
Scott Cain, Ph. D.                                         cain@cshl.org
GMOD Coordinator (http://www.gmod.org/)                     216-392-3087
Cold Spring Harbor Laboratory


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.