Hello all,
Matthew Miller [2022-01-27 13:05 -0500]:
I'd also love to get rid of the entire javascript configuration
system.
That's... more CVEs waiting to happen.
Honestly, I am still stumped how this ever made it past distro review.
Debian/Ubuntu never adopted that and have maintained a fork ever since, as
mozjs was (rightfully) not deemed supportable for a distro's stable lifetime.
So if Fedora ever needs to get off the mozjs thing and go back to the
declarative .pkla files, there's always that option.
(Also, FWIW: security policies should be declarative and auditable, not
imperative and Turing complete. Lua instead of mozjs if you really must, but
rules we ship and recommend should be declarative...)
Thanks,
Martin