[DSE-Dev] Bug#1141939: Bug#1141939: libselinux1 now Recommends selinux-utils, but is this necessary?

[Russell Coker]

On Monday, 13 July 2026 18:20:14 AEST Simon McVittie wrote:
> On Mon, 13 Jul 2026 at 16:58:28 +1000, Russell Coker wrote:
> >The package selinux-utils is depended on by selinux-policy-default, so it
> >will be dragged in by every functional SE Linux system
> 
> On https://salsa.debian.org/selinux-team/libselinux/-/merge_requests/14,
> Adrian argued that "On an embedded system one does often provision
> policy through other means" (presumably meaning that such systems would
> not necessarily have selinux-policy-default installed). Is that a
> use-case that is supported by the SE Linux team in Debian?

That's not something we support in Debian.  For almost everything in Debian 
someone could theoretically install their own non-packaged replacement to save 
some space and we would give them the freedom to do so on their own without 
compromising our work.

I am happy to make things easier for people who want a Frankenstein system, 
but not if that means making things worse for people who do things the 
recommended way.

> If yes, is there a package that is smaller than selinux-policy-default,
> but *does* need to be pulled in by every functional SE Linux system? I'm
> hoping that one of selinux-basics, policycoreutils or selinux-utils has
> that role.

The selinux-basics and policycoreutils packages have depended on selinux-utils 
for a long time.  The selinux-basics package is a convenience package that 
could be skipped if someone wants to keep things small, but policycoreutils is 
really needed for any SE Linux system.

> If all working SE Linux systems will have one of those packages, then
> the same reasoning says that the Recommends isn't necessary.

Yes.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/