David Zeuthen wrote:
Moreover, with the policy daemons reading settings from gconf, who
knows, maybe the system administrator can just tweak a few settings in
the Fedora Directory Server and the changes gets propagated out to his
servers. I really think that's the user experience we want; not some set
of human-editable configuration files in /etc.
Experience tells us that a set of human-editable configuration files is
very reliable. Maybe said set could be read by each client after asking
the policy daemon; this way, we can both (a) let the local administrator
take the matter in his hands, and (b) have a fallback if the policy
daemon is not running, which leads to (c) the local administrator can do
away with the policy daemon entirely and remove (rpm -e) it on
locked-down hosts (hoping nothing is shipped which *requires* the policy
daemons, of course).
Just my $0.02,
Davide Bolcioni
--
Paranoia is a survival asset.