From: Steve Lawrence <slawrence@tresys.com>
To: Dominick Grift <dominick.grift@gmail.com>
Cc: SELinux List <selinux@tycho.nsa.gov>
Subject: Re: [RFC] CIL and Source Policy Integration
Date: Thu, 9 Jan 2014 10:27:04 -0500 [thread overview]
Message-ID: <52CEBFC8.5060506@tresys.com> (raw)
In-Reply-To: <1389279068.15411.6.camel@x220.localdomain>
On 01/09/2014 09:51 AM, Dominick Grift wrote:
> On Thu, 2014-01-09 at 14:35 +0100, Dominick Grift wrote:
>> On Wed, 2014-01-08 at 15:44 -0500, Steve Lawrence wrote:
>>
>>> Thanks, and we look forward to receive your feedback.
>>
>> I played with this a bit this morning. Followed all steps.
>
> When one runs semodule -B, things start to break because of the login
> mappings that disappear, and as a consequence the home dir contexts also
> disappear.
>
> It removes the login mappings, and the content of user home directories
> end up with type default_t
>
> Most of the issues are due to: "cp
> -r /etc/selinux/targeted/{contexts,seusers,setrans.conf} /etc/selinux/cil-test/"
>
> It should work without that step (either that or i am overlooking
> things)
>
>
Considering this patchset really only changes where modules are
installed and the format of those modules, I suspect you're right that
copying the targeted configuration is causing some issues. Plus the fact
that the policy is based on old refpolicy and not fedora policy, I
expected policy related issues. However, the main goal of this RFC was
to determine if the CIL and Source policy integration is headed down the
right path, and determine if there are any high level design flaws or
any issues that need to be worked out for upstream integration to occur.
If the only remaining issue is getting a system working in enforcing, I
think we're okay with that.
We'll continue to look into the issues you described and see if we can
come up with fixes, but I suspect they are more policy/configuration
related, and not problems with the patchset.
Thanks!
- Steve
next prev parent reply other threads:[~2014-01-09 15:27 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-08 20:44 [RFC] CIL and Source Policy Integration Steve Lawrence
2014-01-09 13:35 ` Dominick Grift
2014-01-09 14:51 ` Dominick Grift
2014-01-09 15:27 ` Steve Lawrence [this message]
2014-01-09 16:09 ` Dominick Grift
2014-01-09 16:22 ` Steve Lawrence
2014-01-09 16:32 ` Dominick Grift
2014-01-09 16:15 ` Stephen Smalley
2014-01-09 16:56 ` Steve Lawrence
2014-01-09 18:34 ` James Carter
2014-01-09 19:29 ` Steve Lawrence
2014-01-09 20:47 ` Daniel J Walsh
2014-01-09 21:06 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52CEBFC8.5060506@tresys.com \
--to=slawrence@tresys.com \
--cc=dominick.grift@gmail.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.