Re: rpmlint

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

On Sun, 2006-11-05 at 17:32 -0500, Joshua Brindle wrote:
> Steve Grubb wrote:
> > Hi,
> >
> > Below is a patch that I am thinking about submitting to rpmlint. The main idea
> > of this patch is to catch places where people might be coding policy knowledge
> > into scripts. Chcon would require knowing some types in order to work. If the
> > types ever got changed, the script would break. Can anyone think of other
> > things we do not want to see in rpm scriplets?
> >
> > -Steve
> >
> >   
> calling semanage thusly:
> 
> semanage fcontext -a [any arguments here] /some/file
> 
> actually any semanage command except *possibly* login and user, and I'm 
> not sure they should be there either but someone may have an acceptable 
> scenerio.

If we disallow this then what is the recommended way to allow an
application to ship a labeling only policy? We need to allow
applications to, for example, label a library as textrel_shlib_t without
forcing them to ship a policy module.

What if we added the ability to specify the store by name (i.e.,
semanage -s targeted fcontext -a . . . .). I think it should be
acceptable to make assumptions about what a well know policy contains.
Getting them to use semanage in this way would fix other problems - like
relabeling - without introducing unnecessary policy modules.

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.