Re: [PATCH 25/33] libsemanage: policy server database hooks

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

On Mon, 2007-04-23 at 17:35 -0400, jbrindle@tresys.com wrote:
> plain text document attachment (semanage.ps_api.diff)
> Implements all database functions for a policy server backend.

Any thoughts on how this should be merged? I'm concerned about merging
without a working policy server that has been reviewed as well.

* What are your plans for the policy server - will it be proposed for
inclusion upstream?

* What is the timeline for completion of the policy server?

* Are their any docs at all about the protocol?

* Any progress on the exec-based policy server instead of the long
running daemon?

Basically - this patch set is too large to review, there have been no
ongoing design discussions, there is no way to review large portions of
the patch set due to external dependencies, and I have seen no proposed
plan for merging.

I have voiced these concerns previously and without at least some of the
above I'm opposed merging at this time.

I would suggest as an alternative plan you do a depth-first submission
instead of the breadth-first approach that you are currently attempting.
That would allow a review of the end-to-end design with a relatively
small amount of code. From that point expanding the coverage would only
require a quick review that the patch continues on the already accepted
approach.

That steps that I suggest are:

* Choose a _single_ and _simple_ semanage operation to control.
Something like adding a role to a user.

* Post a minimal policy server that can control this operation
(preferably exec-based).

* Post the libsemange code to communicate with the server _only_ that
single operation.

* Create an example policy that controls this operation that can be used
to test and demonstrate the functionality.

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.