Source Mage code commit list

[Arjan Bouter <abouter AT sourcemage.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 18 Jul 2006 12:16:54 +0200
Ladislav Hagara <ladislav.hagara AT unob.cz> wrote:

> > I know there's been discussion about this on sm-discuss, but I just
> > wanted to add that the easiest solution right now would be to create a
> > git branch for selinux support and move all related changes to that
> > branch. That way everyone who does not work on selinux can just do their
> > work as usual.

that would be fine with me, how are we going to treat software that picks up 
libselinux automatically?
disable it in the normal grimoires? spells like udev?

> 
> 
> I would really like to know how many users of Source Mage GNU/Linux use 
> SELINUX and how many boxes were broken by mu update.

selinux can't be USED at the moment, it's implementation is only partially 
completed. so far I've been carefull to keep it disabled by default. one 
example of this is that i didn't add the needed init script to the grimoire. 
this approach has been working fine for the last year or so.

currently i have selinux working on my own boxes, but in the permissive mode. 
ie it logs access violations but not blocks them. that's needed until 
commands like cp and mv keep the selinux data intact (anyone up to patching 
coreutils?)

basically the update broke every box with libselinux installed and that box' 
SA hit "y" on the selinux prompt.

the question you should be asking is how many users have heavy "y" keys when 
casting spells...
i'm afraid that's a shocking number...

> I am sorry I do not have boxes to test all my updates with and without 
> SELINUX.

what about with and without pam? what about with and without the hardened 
grimoire? what about <insert random spells>
i'm aware that one dev can't test every possible combination and the fact 
that everybody makes mistakes sometimes.
that's not something we can avoid entirely.

what we can avoid is changing the behavior of spells. take the recent shadow 
update as an example. that changed the default pam.d/login to enforce selinux 
checks... caused by switching from our own pam.d/* to the default pam.d/* 
provided by the tarball. those default files are broken on smgl for quite 
some time, exactly the reason we provide our own. that's the kind of thing we 
can avoid by thinking through the changes we make and not assuming it'll work 
everywhere.

and when in doubt, ask. the udev spell has seen a great deal of discussion 
lately, which is great. i'd rather answer some questions on irc or reply to 
some mails than finding myself locked out of my own box a couple of times a 
month.

> I updated and tested non SELINUX version so developers which use SELINUX 
> could update and test SELINUX version.
> It is TEST grimoire.

'echo something >> some-file' based on a env var without checking if that 
something is already in the file is a bug.
not to mention it's a bug that can be avoided. it becomes more of a problem 
if the spell in question is boot/login related and enables partially 
implemented things.

> 
> Is it really important to write about my "fault" in official "This Week 
> in SMGL (July 16th 2006)" [1]?

no it's not, i'd be the last to suggest nailing devs to the wall on mistakes.
but as the discussion on the ML showed, some people feel the need to point 
fingers when having a general discussion.

> Has it been approved by some of Lead Developers or official documents 
> can be written by anybody not using Source Mage GNU/Linux more than 
> seven months?
> According our Ledger the spell libselinux is not installed on any live box.
> Who really use it?

another question, who's using the ledger spell? and is that number a fair 
representation of the amount of smgl users?
i've got libselinux installed on 3 boxes, and it's dormant on a couple of 
others, waiting for the last few spells to have selinux support. if i would 
have ran the update on those boxes, they'd be pretty hard to fix as there's 
no such thing as rebooting with init=/bin/bash through ssh...

full selinux support for smgl is not going to happen at all until someone 
picks up the patching of coreutils.
i'm not a programmer and can't fix it myself. i've repeatedly asked for help, 
but so far nobody has picked it up.

> 
> [1] http://www.sourcemage.org/node/1652
> [2] http://ledger.sourcemage.org/users/statistic_live.php?select=libselinux
> 
> -- 
> Ladislav Hagara
> 
> 
> 
> _______________________________________________
> SM-Commit mailing list
> SM-Commit AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-commit
> 


+=======
Source Mage GNU/Linux developer,
http://www.sourcemage.org
Registered as user #310617 with the Linux Counter,
http://counter.li.org.
GnuPG Key 79D4B14E = 94AD 3FD1 E259 67ED 632E  2B06 CFBE 1154 79D4 B14E
+===
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFEzzefz74RVHnUsU4RAud1AJ4/LxBBBRhTzL22TYya0qOxRCX+pQCcDbB/
GndNPsWryKnKX8zejdWTrbE=
=daLt
-----END PGP SIGNATURE-----