<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Le 18/05/19 à 13:31, Dmitry Bogatov a
écrit :<br>
</div>
<blockquote type="cite" cite="mid:E1hRxYs-0004N5-9j@eggs.gnu.org">
<pre class="moz-quote-pre" wrap="">[2019-05-16 11:43] Laurent Bigonville <a class="moz-txt-link-rfc2396E" href="mailto:bigon@debian.org"><bigon@debian.org></a>
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On Thu, 16 May 2019 08:54:43 +0000 Dmitry Bogatov <a class="moz-txt-link-rfc2396E" href="mailto:KAction@debian.org"><KAction@debian.org></a>
wrote:
>
> From 7f6242e5f3d893e90b3ed44fb09abe5983c2d49a Mon Sep 17 00:00:00 2001
> From: Dmitry Bogatov <a class="moz-txt-link-rfc2396E" href="mailto:KAction@debian.org"><KAction@debian.org></a>
> Date: Wed, 15 May 2019 12:10:13 +0000
> Subject: [PATCH] init: delegate selinux operation to separate binary
Can you please explain the rational behind this?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap=""> This way, /sbin/init is no longer linked aganist libselinux (and its
transitive dependencies).
If user need selinux initialization, she can install
/sbin/selinux-check separately.</pre>
</blockquote>
<p>I've seen that in your commit, I just don't understand why this
is even a goal. libselinux is really small and only pulls libpcre3
which is pulled by grep (which is Essential). It's not possible
today to install debian without libselinux installed anyway.</p>
<p>Also, what's your plan regarding packaging? Would that executable
be put in a separate package? TBRH I spent a lot of time working
opening bugs/submitting patches in debian so the user who wants to
use SELinux can get (an almost) out of the box experience in
debian and I would not really be happy to see that attempt to
revert that in a core component.</p>
<p>If you really (really) want to go that way, maybe you should use
a private path for the helper (as it shouldn't be called my
regular users after the initial load) and/or use a less common
name than "selinux-check".</p>
<blockquote type="cite" cite="mid:E1hRxYs-0004N5-9j@eggs.gnu.org">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">This looks like a bad idea to me. SELinux needs to be initialized as
soon as possible during the boot otherwise this will call for issues.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">As you may see, this patch does not change time during boot, when
selinux functions are called -- only moves them into child process.</pre>
</blockquote>
<p>But you are forking/exec() that usually requires SELinux
permission, however as there would be no policy loaded yet at that
moment that should be allowed by SELinux.</p>
<p>I don't know whether or not that would require a change in
existing policies.<br>
</p>
<br>
<blockquote type="cite" cite="mid:E1hRxYs-0004N5-9j@eggs.gnu.org">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Was that discussed with anybody involved in SELinux in debian and/or
upstream?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">That is exactly place to start discussion. Luckily, Jesse is following
BTS, and I do not have to go through Savannah issue tracker.</pre>
</blockquote>
<p> I was more thinking about upstream SELinux people</p>
<p>
<blockquote type="cite">
<pre class="message">PS. I removed -lselinux from INITLIBS in src/Makefile.</pre>
</blockquote>
You mean -lsepol?<br>
<br>
</p>
</body>
</html>