The possibility of SELinux targeted policy in the default install

[Manoj Srivastava <srivasta@golden-gryphon.com>]

Hi,

        Long past when I thought the tool chain foe SELinux would
 stabilize, we have a working set of packages for the targeted policy
 (the same one Red Hat ships in fedora/rawhide).

        Just installing a SELinux policy package is all that is now
 needed in unstable; that should pull in all the packages it needs.

        With the help of
  apt-rdepends --dotty selinux-policy-refpolicy-targeted
 I have managed to determine that the packages not already included in
 Priority Standard are:

,----[ Additional packages required ]
| Package: selinux-policy-refpolicy-targeted
| Size: 1232692
| Installed-Size: 16712
| 
| Package: policycoreutils
| Size: 348324
| Installed-Size: 3304
| 
| Package: libsemanage1-dev
| Size: 333718
| Installed-Size: 2076
| 
| Package: libsemanage1
| Size: 70910
| Installed-Size: 296
| 
| Package: python-semanage
| Size: 115336
| Installed-Size: 648
| 
| Package: python-selinux
| Size: 61788
| Installed-Size: 308
| 
| Package: python-support
| Size: 22934
| Installed-Size: 104
`----

        The size of the .debs for targeted policy is 2185702 Bytes.

        No special configuration should be required; the default
 configuration out of the box ought to work.

        As shipped, the Debian kernel images have SELinux compiled in,
 but disabled, a command line parameter is required to turn SELinux
 on. When SELinux is turned on (by enabling it in grub), the default
 policy setting are that the machine would come on in permissive mode,
 using the targeted policy; so the worst case scenario is that the
 there would be lots of log messages if someone "accidentally" turned
 on SELinux.

        At this point, the selinux-policy-refpolicy-targeted package
 still needs some love, but we should be close to getting it in shape
 RSN™. We also need the packages uploaded yesterday into Sid to
 migrate to testing.

        Is there some other information I can provide?

        manoj
-- 
Vanilla wafer.
Manoj Srivastava     <srivasta@acm.org>    <http://www.golden-gryphon.com/>
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C