Re: rawhide targeted vs. refpolicy rpm

[Ivan Gyurdiev <ivg2@cornell.edu>]

 
>>> Well, okay... I guess it's about as easy to add an arbitrary prefix 
>>> than to use the current defrole functions.
>>> It's probably easier, actually...
>>>
>>> So, should this go into a separate file? If it's key-ed on the user, 
>>> why shouldn't it go into the user file?
>>> Also, there's the issue of local vs policy. In-policy users that are 
>>> not in the local file also require a labeling prefix.
>>>     
>>
>> For local users, it could go into the users.local file managed by
>> libsemanage.  For in-policy users, the policy package needs to provide a
>> new file that assigns them a labeling prefix for use by libsemanage.
>>   
> Too complicated...fewer files is better. It seems better to call a 
> utility in the %post script that will do if (!exists_local(root)) 
> add_local(root, (root's data)). That also allows users to see that 
> data if they choose to modify the file by hand.
Actually, no this is a very stupid idea, because:

1) it implies prefixes for users only found in policy are local 
modifications, and
2) updates will not override previous value, because they'll think it 
was locally modified.

... another file is the right way to do this.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.