Re: refpolicy updates from debian

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Mon, 2006-09-04 at 21:43 +0200, Erich Schubert wrote:
> > - dropped netuser
> 
> I'm still convinced it's useful.
> It's an easy way of allowing only certain users to setup network
> servers.
> If like, 10% of your users should be allowed to setup network servers,
> the others should not.

I see where it would be useful, I just don't believe its common enough
to be added.

> > - please make a more descriptive name for usbmodules_var_lib_t.  maybe
> > usbmodules_ids_t?
> 
> Right now there is only the usbmodules ids file in there, so that name
> is fine with me. I have no idea if usbmodules might get extra var files
> later on. AFAICT the file is generated from one single source file on my
> system anyway. That might differ for certain USB hardware not supported
> by the stock kernel, though.

After doing a little digging to see where these files are on FC and
Gentoo machines, I see that the existing hwdata_t is the right type for
this.  I have added the appropriate rules and fc entries.  However, I
don't see any options for usbmodules that would have it write to
usb.ids, so why does your patch have this access?

> > - why does system_crond_t connect to mysql?
> 
> I'm not sure, I believe it's cron signaling mysql some maintainance.
> I don't actually use MySQL.
> 
> >From the cronjob:
> # This script only rotates the binary logs. The normal logs are rotated
> # via /etc/logrotate.d/mysql-server.
> 
> I don't know why logrotate is not used for the binary logs, too.

Can you send me a copy of the script off list?

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.