Semodule syntax is broken.

[Daniel J Walsh <dwalsh@redhat.com>]

Currently when rpm ships, it does an 

semodule -b base.pp -i a.pp b,pp c.pp

It should be able to do 

semodule -b base.pp -u a.pp b.pp c.pp

But -u blows up if c.pp was not previously installed.  It should follow the rpm -U syntax; upgrade if the previous package exists and install if it does not.  If we want to add a -F (freshen) this could only upgrade pre-existing modules, and ignore others.

If I was to change to -u, I would need to add a fourth field to policy modules and upgrade it each time I added a patch.  It would be a pain, but I guess I could deal with it.

BUT  A bigger problem is how to deal with an administrator that wants to remove a package and ensure it does not get reinstalled.  If an administrator decides he does not want to install unconfined.pp, we do not want an selinux-policy upgrade to re-install the package.

semodule -r should set a flag when a package gets removed.  Then semodule -u or semodule -i would not install the package unless the  administrator specifies a -f.

semodule -r unconfined

Would create a file in the policy store /etc/selinux/targeted/modules/active/modules/unconfined.exclude.  

semodule -u and semodule -i would respect, and just print out an error message.

semodule -u unconfined.pp
Warning: unconfined.pp is excluded from the policy store, use -f to force the install

Add -q qualifier to quiet this message

# semodule -f -u unconfined.pp
Would install the package and remove the flag.


I would like to get consensus on this before I implement.  Or others can implement.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.