On Mon, 2016-07-04 at 16:34 +0100, Richard W.M. Jones wrote:
I don't exactly know where to post this, but I guess I have
everyone's
attention on this thread.
Attached are patches which work for me. They could really do with
review from someone who knows what they're doing. They also need much
more testing than I've done, but I'll be doing that myself later.
The first patch (against libselinux) sets SELinux to Permissive mode
early in boot if the /.autorelabel file is found (or autorelabel on
the command line).
The second patch (against policycoreutils in Fedora) implements the
generator itself.
Do we actually *need* the second patch if we have the first? I mean, my
suggestion was just to do the first patch; if we do that, do we
actually need to worry about making the relabel happen any earlier than
it currently does?
but yeah, patch #1 looks like what I wanted, so +1 for that. Note that
https://bugzilla.redhat.com/show_bug.cgi?id=1351358 is my bug
suggesting exactly that, so any update which implements patch #1 can be
marked as fixing that bug. thanks for this!
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net