Skip to Content.
Sympa Menu

sm-commit - Re: [SM-Commit] GIT changes to master grimoire by Arjan Bouter (9d237df6bbd9f9323a70924bb5ad854dc91fa493)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Arwed von Merkatz <v.merkatz AT gmx.net>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: Re: [SM-Commit] GIT changes to master grimoire by Arjan Bouter (9d237df6bbd9f9323a70924bb5ad854dc91fa493)
  • Date: Tue, 1 Aug 2006 18:09:22 +0200

On Tue, Aug 01, 2006 at 01:14:39PM +0200, Arjan Bouter wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Tue, 18 Jul 2006 12:16:54 +0200
> Ladislav Hagara <ladislav.hagara AT unob.cz> wrote:
>
> > > I know there's been discussion about this on sm-discuss, but I just
> > > wanted to add that the easiest solution right now would be to create a
> > > git branch for selinux support and move all related changes to that
> > > branch. That way everyone who does not work on selinux can just do their
> > > work as usual.
>
> that would be fine with me, how are we going to treat software that picks
> up libselinux automatically?
> disable it in the normal grimoires? spells like udev?

I'd say disable it in the normal grimoires and have it only used in the
selinux branch.

[...]
> what about with and without pam? what about with and without the hardened
> grimoire? what about <insert random spells>
> i'm aware that one dev can't test every possible combination and the fact
> that everybody makes mistakes sometimes.
> that's not something we can avoid entirely.
>
> what we can avoid is changing the behavior of spells. take the recent
> shadow update as an example. that changed the default pam.d/login to
> enforce selinux checks... caused by switching from our own pam.d/* to the
> default pam.d/* provided by the tarball. those default files are broken on
> smgl for quite some time, exactly the reason we provide our own. that's the
> kind of thing we can avoid by thinking through the changes we make and not
> assuming it'll work everywhere.
>
> and when in doubt, ask. the udev spell has seen a great deal of discussion
> lately, which is great. i'd rather answer some questions on irc or reply to
> some mails than finding myself locked out of my own box a couple of times a
> month.

I agree with you there. We have too many big changes dropped into test
without enough testing. Especially spells that used to work fine and
then get broken by an update exactly because some small detail changed.
We can't avoid all of those changes, though prometheus can help with
detecting those. But any change involving real dependency and/or
behaviour changes (like the pam/shadow case, or the udev SUB_DEPENDS
problem) should only get into test if the developer is _very_ sure that
everything still works as expected. If that is not the case, it should
go to devel (or rather a feature-branch, more on that later this week).

--
Arwed v. Merkatz Source Mage GNU/Linux developer
http://www.sourcemage.org




Archive powered by MHonArc 2.6.24.

Top of Page