Re: [ SEMANAGE ] [ SEPOL ] More database work

[Joshua Brindle <jbrindle@tresys.com>]

Stephen Smalley wrote:
> On Thu, 2005-10-13 at 18:35 -0400, Joshua Brindle wrote:
> 
>>>We still need to decide what to do about the
>>>sepol_module_package_create_file interface to make it extensible; one
>>>option is to discard it and require the caller to build up a
>>>sepol_module_package struct via a create/set_xx/set_yy sequence and then
>>>use the write interface to write the final package file.  It appears the
>>>we would only need/want a set_file_contexts interface at present, as the
>>>policydb is allocated by the create interface and can be extracted via
>>>get and then populated using the other policydb interfaces (read,
>>>expand_module, etc).  The only user of the create_file interface
>>>presently is semodule_package.
>>>
>>>Also need to deal with the package file format itself, i.e. versioning,
>>>sections, etc. per the discussion on fedora-selinux-list.
>>>
>>
>>It also seems like the current CLI for semanage_package is insufficient. 
>>If we are building support into the format and API for sections and 
>>other data the semanage_package options should reflect what sections are 
>>you are filling in with what data, something like
>>
>>-f file_contexts
>>-m module data
>>
>>and anything else added later would obviously get an argument.
> 
> 
> Does it ever make sense to build a package without a module?  If not,
> then I think we can leave the module as a required argument, and only
> make things like file contexts and other components option-driven. 
Sure, I was expecting it to be required, but still use an argument, it 
doesn't matter to me though

> It
> might also help to in some way more clearly distinguish the output file
> from the input arguments to avoid accidentally clobbering a module (I've
> done that before) with semodule_package, either via explicit -o option
> like checkmodule/checkpolicy (with some default output filename) or have
> semodule_package refuse to clobber an existing file.
> .

Yes, another thing I expected to do but didn't mention because it wasn't 
relavent to the file format itself. I've also clobbered modules though :)


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.