On Mon, 2016-07-04 at 22:52 -0500, Bruno Wolff III wrote:
On Mon, Jul 04, 2016 at 10:25:36 -0700,
Adam Williamson <adamwill(a)fedoraproject.org> wrote:
>
> Do we actually *need* the second patch if we have the first? I mean, my
> suggestion was just to do the first patch; if we do that, do we
> actually need to worry about making the relabel happen any earlier than
> it currently does?
Can't processes that start before the relabel is complete, get incorrectly
labelled? If so, that can cause a potentially cause a problem with the
labelling of files created by those processes and access from those
processes if the system shifts to enforcing mode later.
It doesn't. After the relabel it reboots.
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net