New module store + /var being split off

New module store + /var being split off

[Miroslav Grepl]

Hello.

We are close to get the latest userspace (modules store + CIL) into
Fedora. We just have a discussion about "/var" being split off and be
mounted only very late at boot.

Can you think about an issue with that? I don't see any urgent blocker
which blocks the boot process.

Thank you,
Miroslav


-- 
Miroslav Grepl
Senior Software Engineer, SELinux Solutions
Red Hat, Inc.

Re: New module store + /var being split off

[Steve Lawrence]

On 06/12/2015 11:18 AM, Miroslav Grepl wrote:
> Hello.
> 
> We are close to get the latest userspace (modules store + CIL) into
> Fedora. We just have a discussion about "/var" being split off and be
> mounted only very late at boot.
> 
> Can you think about an issue with that? I don't see any urgent blocker
> which blocks the boot process.
> 
> Thank you,
> Miroslav
> 

I don't believe anything in /var/selinux is necessary during boot. The
policy store in /var/selinux is only used with commands like
semodule/semanage/etc. so as long as those aren't run during boot I
suspect it should be fine.

- Steve

Re: New module store + /var being split off

[Sven Vermeulen]

On Fri, Jun 12, 2015 at 05:18:31PM +0200, Miroslav Grepl wrote:
> We are close to get the latest userspace (modules store + CIL) into
> Fedora. We just have a discussion about "/var" being split off and be
> mounted only very late at boot.
> 
> Can you think about an issue with that? I don't see any urgent blocker
> which blocks the boot process.

As far as I can see, there is no impact upon the boot process from anything
in /var/lib/selinux. This location only matters when you want to rebuild the
policy (or manipulate the policy, for instance when SELinux booleans are
being changed and persisted).

In Gentoo we have the 2.4 userspace in our "testing" branch for a while and
I did not receive any reports yet related to /var being a separate file
system. 

Wkr,
        Sven Vermeulen