From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: <4367D13A.1050305@cornell.edu> Date: Tue, 01 Nov 2005 15:34:02 -0500 From: Ivan Gyurdiev MIME-Version: 1.0 To: Stephen Smalley CC: SELinux@tycho.nsa.gov Subject: Re: [ SEMANAGE ] Install seusers, rename some files References: <4366C114.9080708@cornell.edu> <1130875837.22731.289.camel@moss-spartans.epoch.ncsc.mil> In-Reply-To: <1130875837.22731.289.camel@moss-spartans.epoch.ncsc.mil> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov > I'm not sure about this; at present, it has the side effect that a > semodule -b base.pp will fail upon the attempt to copy seusers (because > there isn't one in the sandbox presently, not even an empty stub). Yes, the seusers from /etc/selinux/strict/seusers have to get in the sandbox somehow... I'm not entirely sure how, but I think Tresys has indicated that should occur through the APIs, rather than by copying it in. This is only necessary for migration... > We also have to be careful about not clobbering any existing seusers file > during the migration, although I suppose that will be handled by moving > it into the sandbox upon policy upgrade, as with booleans.local The authoritative seusers file should be in the sandbox. Personally I think all authoritative files should be in the sandbox, and not get copied from place to place... but that's not how things work currently. By the way, direct modifications of the /etc/selinux/seusers file will be overwritten by libsemanage (but I think the goal is that there should be no direct modifications..) -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.