Re: [ SEMANAGE ] Install seusers, rename some files

[Ivan Gyurdiev <ivg2@xxxxxxxxxxx>]

> I'm not sure about this; at present, it has the side effect that a
> semodule -b base.pp will fail upon the attempt to copy seusers (because
> there isn't one in the sandbox presently, not even an empty stub).
Yes, the seusers from /etc/selinux/strict/seusers have to get in the 
sandbox somehow...
I'm not entirely sure how, but I think Tresys has indicated that should 
occur through the APIs, rather than by copying it in.

This is only necessary for migration...
>   We also have to be careful about not clobbering any existing seusers file
> during the migration, although I suppose that will be handled by moving
> it into the sandbox upon policy upgrade, as with booleans.local
The authoritative seusers file should be in the sandbox. Personally I 
think all authoritative files should be in the sandbox, and not get 
copied from place to place...  but that's not how things work currently. 
By the way, direct modifications of the /etc/selinux/seusers file will 
be overwritten by libsemanage (but I think the goal is that there should 
be no direct modifications..)

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.