Re: We are attempting once again to split policy out into individual RPMS.

[Richard Hally <rhally@mindspring.com>]

Daniel J Walsh wrote:
<snip>

> 
> We need the ability for RPM to be able to write a file context on disk 
> without the kernel verifying it.  The kernel should treat this as an 
> unlabeled_t file. the same way it would if I ran
> 
> semodule -i XYZ.pp
> restorecon /usr/bin/XYZ
> semoduel -e XYZ
> 
> I don't think this is an unreasonable request to allow rpm_t to have the 
> privilege of writing the "invalid" context to disk.
> 
> Secondly the rpm team would like to be able to execute the equivalent of 
> matchpathcon(XYZ.pp)  IE be able to extract the FC file mapping from the 
> policy package and combine it with the on disk representation to 
> determine the file context to associate with the new files being put on 
> disk.
> 
> At the end of the rpm install, postinstall would do an semodule -i XYZ.pp.
> 
> We want to start out with just a couple of packages shipping policy to 
> prove the technology and then to allow third parties to ship using this 
> method.
> 
> Dan


What if the files being installed were already labeled with the context?
I.e after the files are built but before being packaged into the rpm, 
the context is applied to the file.

Richard


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.