[DSE-Dev] Bug#1141939: Bug#1141939: libselinux1 now Recommends selinux-utils, but is this necessary?

[Russell Coker]

On Monday, 13 July 2026 03:19:25 AEST Simon McVittie wrote:
> Without detailed knowledge of SELinux, I'd be inclined to agree with
> Luca's assertion that creating this directory isn't/shouldn't be the
> shared library's job: the shared library gets installed on every Debian
> system and into every Debian container (it's transitively Essential),
> but most Debian systems don't actively use SELinux. As a result, I think
> moving the tmpfiles.d snippet from libselinux1 to selinux-utils was a
> good thing to do.
> 
> However, I'm not so sure that adding the Recommends as part of that
> change is desirable. Luca's reasoning for why it was OK to move the
> creation of /run/setrans from libselinux1 to selinux-utils, because
> practical systems with SELinux will have these utilities anyway, seems
> like it would be equally valid even without that Recommends?

The package selinux-utils is depended on by selinux-policy-default, so it will 
be dragged in by every functional SE Linux system and shouldn't need anything 
else.  When SE Linux is disabled there shouldn't be a case where mcstrans is 
looked up.

Thw case of "security=selinux" on the kernel command line with no policy 
installed is not suppprted.

I suggest removing that depends.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/