Re: FC5 policy

[Joshua Brindle <method@gentoo.org>]

Russell Coker wrote:
> http://www.coker.com.au/selinux/fc5/
>
> At the above URL I have my latest packages of FC5 policy with patch and 
> source.  They compile the policy with amavis and clamav policy in base (which 
> can't be included in an FC5 update as the tools are broken and don't support 
> policy moving from a module to base), they have Postgrey policy compiled in, 
> and they have a few other policy changes (such as allowing unconfined_t to 
> kill unlabeled_t processes).
>
>   
um? in what way are the tools broken? It is quite easy to move a module 
to base:

semodule -r clamav -i base-with-clamav.pp

> Also my patch removes some unnecessary and inappropriate access from some 
> domains.  I know that most people don't like removing access from processes, 
> but I think we need to use the principle of least-privilege more seriously.
>   
Who doesn't like removing access from processes? I think we are all on 
the same side here..


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.