SE Linux in Etch - was Release sarge now, or discuss etch issues?
On Tuesday 15 March 2005 09:32, Joey Hess <joeyh@debian.org> wrote:
> The fact that the release team now sees the light at the end of the
> tunnel for the release of sarge means that now is the time we need to
> begin planning for etch. Allowing unstable development to pick back up
> after a release with no clear plan for the next release has been shown
> time and time again to delay the next release by one to two *years*.
> The rest follows from that.
Currently we plan to have libselinux in base for Etch. SE Linux code is in
cron and logrotate which can be simply recompiled for full SE support. Fcron
already is compiled with SE Linux support. The maintainer of sysvinit has
agreed in concept to compile with SE support once libselinux is in base.
We can basically make SE Linux usable by most people with a small amount of
work once the above changes are made.
I would like to see a general goal for Etch to have SE Linux as an option at
install time. The installer needs to ask two questions of the user:
Do you want SE Linux? (yes/no/permissive mode - default no)
Which policy do you want? (strict/targeted - default strict)
If SE Linux is to be installed then the selected policy package has to be
installed, that package will have dependencies for all required utility
packages.
If permissive mode is selected then a simple command will be run to change the
configuration of SE Linux appropriately.
My general idea at this time is to have the kernel used for running the
installer not supporting SE Linux to save disk space for the boot loader.
There is no requirement that a SE Linux kernel be used to install SE Linux.
Note that we may not have SE Linux support for all file system types supported
for the root file system (ReiserFS has only just got support). Ideally the
installer would know about this and not permit the combination of SE Linux
and a file system that doesn't have proper XATTR support. But if the
installer doesn't know about it then someone who chooses SE Linux would just
have to know which file system types that they can use. Ext3 and XFS are the
main file systems that people want to use and they work well with SE Linux.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
Reply to: