Re: Boolean change of names.

[Daniel J Walsh <dwalsh@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/11/2012 12:51 PM, Stephen Smalley wrote:
> On Mon, 2012-06-11 at 12:12 -0400, Daniel J Walsh wrote:
>> We have started pushing a boolean change into Fedora 18.
>> 
>> https://fedoraproject.org/wiki/Features/SELinuxBooleansRename
>> 
>> The problem we are seeing is that boolean names used within an interface
>> are causing the install to fail on rebuild of policy.
>> 
>> IE If I installed a custom policy with a boolean used in it, and the
>> boolean changed then the module will blow up the policy compile.
>> 
>> 
>> interface(`kerberos_manage_host_rcache',` gen_require(` type
>> krb5_host_rcache_t; ')
>> 
>> ...
>> 
>> tunable_policy(`allow_kerberos',` allow $1 self:process setfscreate; ... 
>> ')
>> 
>> ... ')
>> 
>> And change the allow_kerberos to kerberos_enabled.
>> 
>> One idea would be to pull the translations into the semanage, or would I
>> need to do this at a lower level.  Or are we stuck with these bad names
>> forever...
> 
> Adding boolean aliases to the policy language, including kernel support, 
> seems like the best route if you truly want to do this.
> 

I disagree, this is just a translation problem.  We can build it into the
toolchain and not dirty up the kernel.

I would prefer to go with the simpler root and not dirty up
/sys/fs/selinux/booleans.



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk/WLK8ACgkQrlYvE4MpobN8AwCgvk9TPyuDdTyAqXnkKVtSAn1m
6sEAoOVm5f86/PFhbSeZXXRernQr/lxn
=BA5Z
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.