[refpolicy] services_nut.patch

[stefan@seekline.net (Stefan Schulze Frielinghaus)]

On Mon, 2009-11-23 at 10:19 -0500, Christopher J. PeBenito wrote:
> On Mon, 2009-11-23 at 15:36 +0100, Stefan Schulze Frielinghaus wrote:
> > On Mon, 2009-11-23 at 14:05 +0100, Miroslav Grepl wrote:
> > [...]
> > > > Another question, what is the intention of the following
> > > >
> > > > permissive upsd_t;
> > > > permissive upsdrvctl_t;
> > > > permissive upsmon_t;
> > > >
> > > > Does that make the domain permissive by default?
> > > Yes, it does. We add new domains to permissive so we can fix all the avc's without blocking of functionality apps.
> > 
> > But not for refpolicy, right? I cannot find any such statement in the
> > policy modules of refpolicy. At least I wouldn't expect such a behavior
> > from modules of refpolicy. I guess we can remove those three lines.
> > 
> > If you are fine with the merge of both policies then we can commit it
> > (after the port change of course).
> 
> My policy is to not have permissive domains in upstream refpolicy.  If
> the modules need more work the patch is dropped.  Otherwise the
> permissive is dropped.

Yes, this is what I thought. Since I use the NUT policy for about a year
and it has some intersection with Miroslavs policy (he uses NUT with a
ups attached via USB and my via SNMP), I would say it is stable enough.