Installing new policy?
Russell Coker
russell at coker.com.au
Tue Mar 9 04:33:36 UTC 2004
On Tue, 9 Mar 2004 04:53, Tom Mitchell <mitch48 at yahoo.com> wrote:
> If you're pushing new policy that actually fixes bugs will it break site
> policy? I would be unhappy if my co-lo box had this line changed. ;-)
> # uncomment to allow ssh logins as sysadm_r:sysadm_t
> define(`ssh_sysadm_login')
This is a difficult issue. For Debian I have it ask a heap of questions at
policy upgrade time about replacing policy files, but lots of people seem to
dislike that.
One possibility is to replace files that have not been changed. However that
means that if a macro changes without the calling code changing then it could
break policy compiles.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
More information about the fedora-selinux-list
mailing list