I think moving the local files into the sandbox upon policy update (via
%post scriptlet in the policy package) is reasonable, as this is only
needed for migration and will not be done subsequently.
I guess at that point we also want to migrate booleans.local,
local.users, and install the base module?
Dan, can you add such a script?
- copy /etc/selinux/?/seusers into /etc/selinux/?/modules/active/seusers
- copy /etc/selinux/?/local.users into
/etc/selinux/?/modules/active/users.local [ renamed ]
- copy /etc/selinux/?/booleans.local into
/etc/selinux/?/modules/active/booleans.local
- install base module into /etc/selinux/?/modules/active/base.pp (is
this managed by rpm?)