Re: RPM support for SELinux

[Joshua Brindle <method@manicmethod.com>]

Jeff Johnson wrote:
>
> On Oct 22, 2009, at 2:37 PM, Chad Sellers wrote:
>
>> I just wanted to let everyone know that we've submitted a patchset to add
>> more robust SELinux support to RPM4. You can view the patchset here:
>>
>> http://lists.rpm.org/pipermail/rpm-maint/2009-October/002561.html
>>
>> Note that these patches require running on the current trunk of
>> libselinux
>> and libsemanage.
>>
>> If you're interested in trying out the support or just looking at how it
>> works, we've put up a wiki page talking about it here:
>>
>> http://selinuxproject.org/page/RPM
>>
>> Comments are welcome.
>>
>
>
> Just a short reply:
>
> The patches will never be included @rpm5.org as is because
> you missed the abstraction (for packaging) and haven't tied
> various stray identifiers as in
> Type: mls targeted

These should never be "concrete" in RPM. These are identifiers that are 
created on end systems and forcing a specific set of them is a good way 
to make sure custom solutions won't use this feature in RPM.

> to anything concrete.
>
> There are other and deeper flaws within the highly unnormalized data
> within the *.bz2 policy blobs.
>

Well, you can normalize the data if you want but chances are the format 
will be changing from the current binary blob to a text file parseable 
only by high level compilers on the end systems in the near future.

> Equivalent functionality will be done @rpm5.org instead.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.