Re: SELinux on Wheezy

[Stephen Smalley <sds@tycho.nsa.gov>]

On Wed, 2012-02-08 at 13:32 -0800, C.J. Adams-Collier KF7BMP wrote:
> Okay.  Do these ever get purged under any other circumstances?  I noted
> that when I booted without selinux enabled and then with it enabled, the
> filesystem was re-labeled.  Does anything else get triggered in this
> situation?  Specifically, do policies get removed?

No.

> It looks like the alsa.pp is failing, so my working and slightly
> modified command was:

That's interesting, and it might explain why your policy didn't get
fully installed originally.  Is that alsa.pp file from the current
selinux-policy package or is it a leftover of an older one?  What is the
error you get with it?  It should be removed if it doesn't work.

>         $ pushd /usr/share/selinux/default
>         $ time sudo \
>         semodule -i `ls *.pp | grep -v -e 'base.pp' -e 'alsa.pp'`
>         
>         real	0m24.148s
>         user	0m23.249s
>         sys	0m0.628s
>         
> This seems like it would take slightly less time than piping the output
> of ls to xargs, since it only runs semodule once.
> 
>         $ time ls *.pp | grep -v -e 'base.pp' -e 'alsa.pp' | \
>         xargs sudo semodule -b base.pp -i 
>         
>         real	0m25.659s
>         user	0m24.778s
>         sys	0m0.660s
> 
> But they both get the job done and the difference in run time is very
> small.

Feel free to submit a patch for the EXAMPLES section in the semodule man
page.  Even better would be to improve semodule so that it automatically
detects the base module and handles it so that you can just do semodule
-i *.pp in all cases and not have to worry about filtering the list and
handling base specially.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.