Re: [RFC] selinux-support (1.0.1) available

["Lorenzo Hernández García-Hierro" <lorenzo@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 2475 bytes --]

El vie, 25-03-2005 a las 09:27 -0500, Stephen Smalley escribió:
> On Fri, 2005-03-25 at 09:08 -0500, Stephen Smalley wrote:
> > Can you explain the purpose of this package?  I'm not sure I understand
> > what you mean, or why the above packages would depend on it.  What is
> > the purpose of the /etc/selinux.conf file in this package, and how does
> > it compare to the already existing /etc/selinux/config file that is
> > being used by libselinux and various scripts?  Do you expect this to
> > remain Ubuntu-specific?
> 
> Another question is how are you handling the SELinux-patched userspace
> in Ubuntu?  Integrated into the main packages as in Fedora or a separate
> set of packages like Russell Coker's current packages for Debian?  The
> former is obviously preferable if possible.

Integrated, I'm right now working with some packages, just finished
logrotate, now working on sysvinit, openssh and PAM.

Each modified package should depend on the proper libraries: ie.
libselinux1 and libselinux1-dev

I'm putting them on http://pearls.tuxedo-es.org/selinux/ubuntu/ among
updated packages of libselinux1 and others.

> Note that you should check the latest SELinux userspace patches from the
> Fedora CVS tree, as they have continued to evolve.  Note that there are
> now two separate SELinux-related patches for sysvinit in the Fedora CVS
> tree, sysvinit-selinux.patch and sysvinit-2.85-selgenusers.patch, where
> the latter patch was a more recent change to support pulling in
> local.users at policy load time without requiring a policy rebuild.

Right, the patches imported from the Fedora CVS being used are hosted
on:
http://pearls.tuxedo-es.org/selinux/userland-patches/

Sysvinit will need more work to get also other interesting patches, I'm
working on it.

> Also note that in some cases, SELinux support has gone into the main
> sources in the Fedora packages and is no longer a separate patch at all
> (or if a patch exists, it is a refinement of the original SELinux
> support rather than the complete SELinux support), e.g. for libuser,
> logrotate, passwd, prelink, etc.

Right, in this case, I would like to know if there's someone from Red
Hat interested in getting in touch with the sources, thus providing
separate patches, or we won't be able to handle this correctly.

Cheers,
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]