Re: [RFC] Upstream policy handling

[Daniel J Walsh <dwalsh@redhat.com>]

I think we do want to start moving strict policy back.  A lot of the 
changes and tunables we added were to make
SELinux work in a mainstream operating system.  This finally led us to 
the targeted policy which can satisfy our
desire to add some SELinux functionality to the Masses without leading 
them to turn it off and worse bury our
support centers with calls.  :^(  I see even targeted policy slowly 
moving toward strict policy over then next few
years as we better undestand how MAC can work in a mainstream operating 
system.

So I have no problem with moving strict policy back towards a more 
strict behavior and the elimination of some tunables.
(Singleuserdomain should be eliminated).  Some of the unlimitedXYZ 
should be removed also, as long as the people using
strict policy can put up with the pain, and it would probably force us 
to fix some more applications. 

As far as the policy having a Red Hat bent, this is because we have 
probably submitted more patches to policy then any other
distro.  

I would like to get to the point that policy-sources would only be 
installed like kernel-sources is now.  IE only required for
developers. 

Allowing sysadmin's to configure policy via booleans is in my opinion a 
much better way to go.

I believe that having Stephen and NSA as being the final Policy CZar is 
the way to go and I worry about distributions, not
submitting the patches to policy for peer review.

Dan

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.