[refpolicy] [RFC] drop nodecons

[paul.moore@hp.com (Paul Moore)]

On Monday 12 January 2009 10:34:49 am Chris PeBenito wrote:
> On Fri, 2009-01-09 at 16:11 -0500, Paul Moore wrote:
> > On Friday 09 January 2009 8:33:49 am Christopher J. PeBenito wrote:
> > > On Thu, 2009-01-08 at 10:45 -0500, Paul Moore wrote:
> > > > On Thursday 08 January 2009 9:17:11 am Stephen Smalley wrote:
> > > > > On Wed, 2009-01-07 at 17:20 -0500, Paul Moore wrote:
> > > > > > The next step is to get semanage to label network nodes (or
> > > > > > fix it if it is broken).
> > > > >
> > > > > semanage node support exists, but might not correctly handle
> > > > > conflicting/overlapping definitions between the base policy
> > > > > and local customizations.  See prior discussion on Adding
> > > > > local nodecon's through semanage on selinux list.
> > > >
> > > > Yep, I've still got that thread marked in my inbox as something
> > > > to revisit.  It will grow more important once we enable the
> > > > network peer controls policy capability (Chris,
> > > > thoughts/comments on the patch I posted regardint that?).
> > >
> > > I'm not ready to drop the protocol-specific interfaces. 
> > > Refpolicy still supports back to RHEL4, so the granularity of the
> > > original networking controls is still important.
> >
> > Okay fair enough.  Let me know what you think about the patch I
> > submitted to enable the network_peer_controls policy capability;
> > I'm really hoping that we can enable this for F11.
>
> As far as I can see, the only related part for that is the hunk that
> uncomments the capability.  Perhaps you should resend it?

There was some other small fixes needed to allow unlabeled_t traffic.  
Resending is a good idea, we can continue the discussion then ...

Thanks.

-- 
paul moore
linux @ hp