On Sun, Jul 12, 2015 at 04:46:03PM -0700, S. Lockwood-Childs wrote: > I'd appreciate feedback on a blog-style article[1] talking about > how CIL is going to improve SELinux policy maintenance, and in > particular, the last section where I try to point out how good Gentoo > is for experimenting with SELinux technologies. The article is > maintained as an rst file in github[2], so corrections/additions > could be submitted as a pull request if desired (though plain old > mailing list replies are equally welcome). > > [1] http://vctlabs.com/posts/2015/Jul/12/selinux_cil/ > [2] > https://github.com/VCTLabs/vct-web/blob/master/content/articles/selinux_cil.rst
Hi, Overall a good article. One thing which I would also point out together with the move to CIL is that there is now no "base" module. In the 2.3 and earlier userlands, all the important things were in "base.pp" and then other things were added separately as modules. One of the reasons why modifying ports works in the 2.4 userland is that there is no more base, it is treated just like any other module now so the limitations of eg ports must be in base no longer apply. Secondly, related to "poor support for preserving local changes across system updates". The tools now have the concept of priority so users can easy completely replace a distro-provided module at a higher priority (semodule -X 900 -i foo.pp). I haven't (yet) updated our selinux eclass to install at a lower priority but will hopefully do that soon. Not sure if you are aware of it, but there is also a project to write a direct refpol -> cil compiler without going via .pp[1]. It looks like it has stagnated for a while but it will hopefully make the generated cil files a little less ugly than they currently are. [1]: https://bitbucket.org/jwcarter/fpp.git -- Jason
