Hi,
On Mon, 2013-10-07 at 10:34 -0400, Russell Doty wrote:
The good news is that this approach increases the quality of our software. The bad news is that it makes it important to keep tests in sync with the software. Actually, that is good news - it prevents us from building up a huge technical debt in out of date tests.
It looks like SELinux is showing up a lot. This isn't a surprise; SELinux isn't that important for development.
It's important not to defer the selinux work for too long, though, and better to keep the policy up to date if possible rather than ignore it and try to fix it all at once.
However, we do have to ensure that OpenLMI works with SELinux in enforcing mode and that we don't have SELinux AVC denials.
Just a quick warning --- it's quite possible to get AVC denials in permissive mode that are not present in enforcing, so it's better if possible to run enforcing and fix the AVCs seen that way than to try to fix everything in the policy in permissive mode.
(Enforcing mode can result in a series of operations being stopped at the beginning with a single "dontaudit" denial, which won't appear in the logs; run that in permissive mode and the initial dontaudit check will succeed but subsequent operations will unexpectedly run and cause additional AVCs.)
--Stephen