Fedora buildsys and SELinux

[Karsten 'quaid' Wade]

On Thu, 2008-04-17 at 10:43 +1000, James Morris wrote:
> On Wed, 16 Apr 2008, Bill Nottingham wrote:
> 
> > James Morris (jmorris at namei.org) said: 
> > > > * All the parties are here now needed to figure this out
> > > > * Someone better than me is going to reply with specifics about what is
> > > > not working in the buildsys
> > > > * We all agree it's pretty important to get this figured out in a good
> > > > way
> > > 
> > > Can you please explain specifically what the problem is?
> > 
> > You cannot create files in a chroot of a context not known by the
> > host policy. This means that if your host is running RHEL 5, you are
> > unable to compose any trees/images/livecds with SELinux enabled for
> > later releases.
> 
> Ok, that's what I suspected.
> 
> One of the possible plans for this is to allow a process to run in a 
> separate policy namespace, and probably also utilize namespace support in 
> general.
> 
> This is non-trivial and needs more analysis.

Thanks.  When we get to the point of needing to justify resource
allocation on the Red Hat side, I'm here to present the "Fedora
leadership request", if needed.  Otherwise, not sure if this is going to
be important enough to the intersecting sets of Fedoran and SELinux
hacker who are not part of the @redhat.com set.

- Karsten
-- 
Karsten Wade, Sr. Developer Community Mgr.
Dev Fu : http://developer.redhatmagazine.com
Fedora : http://quaid.fedorapeople.org
gpg key : AD0E0C41
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/fedora-selinux-list/attachments/20080416/e2fa87d3/attachment.sig>