Skip to Content.
Sympa Menu

sm-commit - Re: [SM-Commit] GIT changes to master grimoire by Arjan Bouter (9d237df6bbd9f9323a70924bb5ad854dc91fa493)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Arjan Bouter <abouter AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: Re: [SM-Commit] GIT changes to master grimoire by Arjan Bouter (9d237df6bbd9f9323a70924bb5ad854dc91fa493)
  • Date: Tue, 1 Aug 2006 13:14:39 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 18 Jul 2006 12:16:54 +0200
Ladislav Hagara <ladislav.hagara AT unob.cz> wrote:

> > I know there's been discussion about this on sm-discuss, but I just
> > wanted to add that the easiest solution right now would be to create a
> > git branch for selinux support and move all related changes to that
> > branch. That way everyone who does not work on selinux can just do their
> > work as usual.

that would be fine with me, how are we going to treat software that picks up
libselinux automatically?
disable it in the normal grimoires? spells like udev?

>
>
> I would really like to know how many users of Source Mage GNU/Linux use
> SELINUX and how many boxes were broken by mu update.

selinux can't be USED at the moment, it's implementation is only partially
completed. so far I've been carefull to keep it disabled by default. one
example of this is that i didn't add the needed init script to the grimoire.
this approach has been working fine for the last year or so.

currently i have selinux working on my own boxes, but in the permissive mode.
ie it logs access violations but not blocks them. that's needed until
commands like cp and mv keep the selinux data intact (anyone up to patching
coreutils?)

basically the update broke every box with libselinux installed and that box'
SA hit "y" on the selinux prompt.

the question you should be asking is how many users have heavy "y" keys when
casting spells...
i'm afraid that's a shocking number...

> I am sorry I do not have boxes to test all my updates with and without
> SELINUX.

what about with and without pam? what about with and without the hardened
grimoire? what about <insert random spells>
i'm aware that one dev can't test every possible combination and the fact
that everybody makes mistakes sometimes.
that's not something we can avoid entirely.

what we can avoid is changing the behavior of spells. take the recent shadow
update as an example. that changed the default pam.d/login to enforce selinux
checks... caused by switching from our own pam.d/* to the default pam.d/*
provided by the tarball. those default files are broken on smgl for quite
some time, exactly the reason we provide our own. that's the kind of thing we
can avoid by thinking through the changes we make and not assuming it'll work
everywhere.

and when in doubt, ask. the udev spell has seen a great deal of discussion
lately, which is great. i'd rather answer some questions on irc or reply to
some mails than finding myself locked out of my own box a couple of times a
month.

> I updated and tested non SELINUX version so developers which use SELINUX
> could update and test SELINUX version.
> It is TEST grimoire.

'echo something >> some-file' based on a env var without checking if that
something is already in the file is a bug.
not to mention it's a bug that can be avoided. it becomes more of a problem
if the spell in question is boot/login related and enables partially
implemented things.

>
> Is it really important to write about my "fault" in official "This Week
> in SMGL (July 16th 2006)" [1]?

no it's not, i'd be the last to suggest nailing devs to the wall on mistakes.
but as the discussion on the ML showed, some people feel the need to point
fingers when having a general discussion.

> Has it been approved by some of Lead Developers or official documents
> can be written by anybody not using Source Mage GNU/Linux more than
> seven months?
> According our Ledger the spell libselinux is not installed on any live box.
> Who really use it?

another question, who's using the ledger spell? and is that number a fair
representation of the amount of smgl users?
i've got libselinux installed on 3 boxes, and it's dormant on a couple of
others, waiting for the last few spells to have selinux support. if i would
have ran the update on those boxes, they'd be pretty hard to fix as there's
no such thing as rebooting with init=/bin/bash through ssh...

full selinux support for smgl is not going to happen at all until someone
picks up the patching of coreutils.
i'm not a programmer and can't fix it myself. i've repeatedly asked for help,
but so far nobody has picked it up.

>
> [1] http://www.sourcemage.org/node/1652
> [2] http://ledger.sourcemage.org/users/statistic_live.php?select=libselinux
>
> --
> Ladislav Hagara
>
>
>
> _______________________________________________
> SM-Commit mailing list
> SM-Commit AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-commit
>


+=======
Source Mage GNU/Linux developer,
http://www.sourcemage.org
Registered as user #310617 with the Linux Counter,
http://counter.li.org.
GnuPG Key 79D4B14E = 94AD 3FD1 E259 67ED 632E 2B06 CFBE 1154 79D4 B14E
+===
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFEzzefz74RVHnUsU4RAud1AJ4/LxBBBRhTzL22TYya0qOxRCX+pQCcDbB/
GndNPsWryKnKX8zejdWTrbE=
=daLt
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page