Re: [ SELINUX ] [ POLICYCOREUTILS ] Convert setsebool -P to use libsemanage

[Ivan Gyurdiev <ivg2@cornell.edu>]

> I'm not sure I understand the question.  load_policy is supposed to
> preserve current boolean settings across a reload so that a transient
> boolean change isn't affected by a policy update.  Examples of transient
> boolean changes might include setting of booleans from cron jobs for
> time-of-day policies, manual setting of booleans without -P by an admin
> to reflect some external event, setting of booleans by an IDS in
> response to some detected attack, etc.  That behavior isn't supposed to
> change even with the introduction of libsemanage and the use of
> SETLOCALDEFS=0 (which only turns off setting the booleans from the
> booleans* files upon initial policy load, as they are now set in the
> generated kernel binary policy file by libsemanage).
>   
So, how do I specify that this is not a transient change, and I want my 
booleans loaded into policy immediately?
>> Note2: if I go and force libsemanage to pass -b flag, it works just 
>> fine, but takes forever (10sec) to complete. It's not my fault, the 
>> module expand function is just really really slow.
>>     
>
> echo "expand-check = 0" >> /etc/selinux/semanage.conf, as I noted
> earlier, for development/debugging purposes.  We may want to allow
> setting the expand check state on a per-handle basis to disable for
> certain kinds of transactions, just as one can presently disable
> immediate reload for certain transactions.
>   
I think I'll try to add all kinds of shortcuts by tracking exactly what 
the user is trying to do...
If there are no module changes, we can reuse the old "base.expanded" file.
If there are no policy changes, we can skip rebuilding the policy. So, 
if only seusers
were changed, we only need to read the policy.kern, instead of 
reconstructing it.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.