On Mon, 21 May 2007 20:05:54 +1000, Russell Coker <[EMAIL PROTECTED]> said:
>> localStrict.te included below). I can compile my packages, and run
> Does localStrict.te really provide a benefit?
It quells any AVC messages; and some of them were quite
prolific. This way, any new messages are not lost in a flood of known
issues.
For me, personally, it allows me to stage in changes in policy,
and play around with apol, before deciding whether or not to move any
changes into Debian's refpolicy.
> Now further changes: It's probably best to permit getattr access when
> read access is permitted, I omitted this in the
> fs_allow_tmpfs_file_read patch I sent you.
> I'll send other patches soon.
Thanks.
I have now run my UML machine for four days with no
activity, to capture any default cron jobs that might run into
problems with strict policy. I did it over the weekend, to capture
anything special over Saturday and Sunday; and there have been no
activity in the logs. So at least a minimal build machine at rest is
now fine with strict policy.
I think we might be able to move closer to having grub options
available for users in lenny -- for example, excerpts from my
grub menu.lst are:
# kopt=root=/dev/hda6 ro vga=791 splash=silent
# alternative=true
# defoptions=selinux=0 audit=0
# altoptions=(recovery mode) selnux=0 audit=0 single
# altoptions=(SELinux) selinux=1 audit=1
With this, booting into SELinux can be as simple as selecting
the proper boot image.
manoj
--
A man paints with his brains and not with his hands.
Manoj Srivastava <[EMAIL PROTECTED]> <http://www.debian.org/~srivasta/>
1024D/BF24424C print 4966 F272 D093 B493 410B 924B 21BA DABB BF24 424C
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
