On Sat, 2013-05-18 at 19:22 +0200, Tomasz Torcz wrote:
On Sat, May 18, 2013 at 10:12:52AM -0700, Adam Williamson wrote:
> On Sat, 2013-05-18 at 06:18 -0400, Daniel J Walsh wrote:
> >
https://bugzilla.redhat.com/show_bug.cgi?id=962081
> >
> > I have a request to change the name of selinux-policy-devel to
> > selinux-policy-devel-support, since
> >
> > "everywhere else in the distro -devel means just header files in c and not
any
> > other development tools and we have several scripts that assume that's the
case."
> >
> > selinux-policy-devel contains interface files and tools required to build
> > selinux-policy. It also currently contains the man pages, which I can move to
> > the base package.
>
> Well, there may have been some signals crossed somewhere. I've been part
> of the discussion about reducing the size of the desktop spin.
> selinux-policy-devel doesn't look bad to me, the one that looks like a
> problem is policycoreutils-devel :
>
> "The policycoreutils-devel package contains the management tools use to
> develop policy in an SELinux environment."
>
> Now *that* is a non-standard interpretation of the -devel suffix. And
> policycoreutils-devel requires selinux-policy-devel - a package of
> 'runtime' stuff depending on a package of 'build time' stuff - and
> various 'runtime' packages depend on policycoreutils-devel, notably the
> SELinux troubleshooting thing, because policycoreutils-devel contains
> audit2allow.
SELinux *management* often means *building* parts of policy. That's
the problem, right?
Right, exactly. 'developing' SELinux policy is not an act of
'development' like writing code, and it's something we quite actively
offer to people at run time - one of the actions the SELinux
troubleshooting GUI offers in many AVC cases is 'run audit2allow to
generate a policy that will allow this action', for instance, hence its
dependency on policycoreutils-devel.
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | identi.ca: adamwfedora
http://www.happyassassin.net