On Fri, Mar 31, 2023 at 10:49 AM David Sommerseth <dazo(a)eurephia.org> wrote:
On 31/03/2023 16:36, Neal Gompa wrote:
> On Fri, Mar 31, 2023 at 9:58 AM David Sommerseth <dazo(a)eurephia.org> wrote:
>>
>>
>> Hi,
>>
>> I had an upstream SELinux pull-request merged in autumn 2020 [1]. But I
>> still don't see this SELinux boolean flag (renamed [2] to
>> "dbus_pass_tuntap_fd") present in Fedora 38. So I wonder how the
>> SELinux refpolicy is consumed into Fedora's SELinux policies ... when
>> can I expect to see this in Fedora and RHEL SELinux policies?
>>
>> [1]
>>
<
https://github.com/SELinuxProject/refpolicy/commit/79c7859a4807236693c734...
>> [2]
>>
<
https://github.com/SELinuxProject/refpolicy/commit/ba3818ebcc3a627bc331c6...
>>
>
> It's not consumed by Fedora or openSUSE at all. Fedora and openSUSE
> follow this instead:
https://github.com/fedora-selinux/selinux-policy
>
> As far as I know, there has been no reconciliation between the two
> happening anytime in the recent past and it's unlikely to happen
> anytime soon.
Maybe not the right place to ask ... but what is the purpose and goal of
the SELinux refpolicy project if several of the larger Linux
distributions doesn't pay attention to it?
I kinda would expect that lots of the SELinux policy details in Fedora
would be pretty much the same challenges in other distributions as well.
They are. I had a conversation about SELinux vs AppArmor several years
ago in Debian where the Debian folks didn't want to do anything with
SELinux because it was so broken for them. I found out they were
packaging the Tresys refpolicy instead of using our policy and advised
them to change it. Unfortunately, that didn't happen, and I think they
promote AppArmor these days because upstream AppArmor profiles can be
used on any distribution pretty much without issues.
I don't know what caused the policy splinter for SELinux, but as far
as I know, it can't be fixed.
--
真実はいつも一つ!/ Always, there's only one truth!