Tom we need to find place in /etc/rc.d/init.d/ where we can turn
selinux OFF! If your not using it don't let init turn anything on. I will watch this computer come on and see if Selinux is turned on. I think it is.
Turning it off is easy, I'm trying to get rid of the packages so I don't have to keep downloading updates for them :-).
P.S. To turn it off edit /etc/sysconfig/selinux and tell it to be disabled (or if you are a belt and suspenders guy, you could also edit /boot/grub/grub.conf and put selinux=0 as a kernel boot option).
P.P.S. Trying to remove everything except libselinux doesn't work, it still insists on removing every rpm on the system. Trying again with all the other lib-whatever packages associated with selinux give the same results. It acts a lot like everything depends on every selinux package.
Tom Horsley wrote:
Tom we need to find place in /etc/rc.d/init.d/ where we can turn
selinux OFF! If your not using it don't let init turn anything on. I will watch this computer come on and see if Selinux is turned on. I think it is.
Turning it off is easy, I'm trying to get rid of the packages so I don't have to keep downloading updates for them :-).
P.S. To turn it off edit /etc/sysconfig/selinux and tell it to be disabled (or if you are a belt and suspenders guy, you could also edit /boot/grub/grub.conf and put selinux=0 as a kernel boot option).
P.P.S. Trying to remove everything except libselinux doesn't work, it still insists on removing every rpm on the system. Trying again with all the other lib-whatever packages associated with selinux give the same results. It acts a lot like everything depends on every selinux package.
The most actively updated selinux package is selinux-policy. So you should be able to remove this without too many dependencies.
policycoreutils does have lots of packages that require it so getting rid of it will be a problem. libselinux is a core library which you can't remove. libsemanage and libsepol are required by policycoreutils.
So I would just remove selinux-policy-* and you should see far less updates.
On Wed, 2007-06-27 at 11:26 +0000, Tom Horsley wrote:
P.P.S. Trying to remove everything except libselinux doesn't work, it still insists on removing every rpm on the system. Trying again with all the other lib-whatever packages associated with selinux give the same results. It acts a lot like everything depends on every selinux package.
There's a bit of a circular dependency. Applications *have* to be SELinux aware so that files are created with proper contexts for when SELinux is used.
Minimising its impact on you could probably done the best with just three steps.
Disabling it. Disabling its scanning CRON scripts. Ignoring all updates to SELinux (add exlude rules to yum.conf).
Alternatively, leave it running and sort out what else it is that's not playing nicely with it. I haven't found it to be too much of a pain since about FC4.
On Thu, 28 Jun 2007 16:09:01 +0930 Tim ignored_mailbox@yahoo.com.au wrote:
Disabling it. Disabling its scanning CRON scripts.
Did that right off the bat.
Ignoring all updates to SELinux (add exlude rules to yum.conf).
I'd assume that would quickly break down as the things that depend on it decided they needed newer versions installed.
Tim:
Ignoring all updates to SELinux (add exlude rules to yum.conf).
Tom Horsley:
I'd assume that would quickly break down as the things that depend on it decided they needed newer versions installed.
Try it, and see. I don't see too many changes to the SELinux policy files (*its* default rules, etc.), I don't recall it forcing other things to update at the same time. There's only four obvious SELinux packages on my system:
[tim@bigblack ~]$ rpm -qa *selinux* libselinux-2.0.13-1.fc7 selinux-policy-targeted-2.6.4-21.fc7 libselinux-python-2.0.13-1.fc7 selinux-policy-2.6.4-21.fc7
Tim wrote:
Tim:
Ignoring all updates to SELinux (add exlude rules to yum.conf).
Tom Horsley:
I'd assume that would quickly break down as the things that depend on it decided they needed newer versions installed.
Try it, and see. I don't see too many changes to the SELinux policy files (*its* default rules, etc.), I don't recall it forcing other things to update at the same time. There's only four obvious SELinux packages on my system:
[tim@bigblack ~]$ rpm -qa *selinux* libselinux-2.0.13-1.fc7 selinux-policy-targeted-2.6.4-21.fc7 libselinux-python-2.0.13-1.fc7 selinux-policy-2.6.4-21.fc7
rpm -qa *policy* libse* libsepol-2.0.4-1.fc8 checkpolicy-debuginfo-2.0.3-1.fc8 selinux-policy-3.0.1-3.fc8 libsemanage-debuginfo-2.0.3-1.fc7 policycoreutils-2.0.22-3.fc8 libselinux-python-2.0.22-1.fc8 libsemanage-devel-2.0.3-3.fc8 libsepol-devel-2.0.4-1.fc8 libsexy-0.1.11-1.fc7 policycoreutils-gui-2.0.22-3.fc8 libsepol-debuginfo-2.0.3-1.fc7 policycoreutils-debuginfo-2.0.19-4.fc8 libselinux-devel-2.0.22-1.fc8 selinux-policy-targeted-3.0.1-3.fc8 checkpolicy-2.0.3-2.fc8 libselinux-debuginfo-2.0.21-2.fc8 selinux-policy-devel-3.0.1-3.fc8 libselinux-2.0.22-1.fc8 libsemanage-2.0.3-3.fc8 policycoreutils-newrole-2.0.22-3.fc8
Tim:
There's only four obvious SELinux packages on my system:
[tim@bigblack ~]$ rpm -qa *selinux* libselinux-2.0.13-1.fc7 selinux-policy-targeted-2.6.4-21.fc7 libselinux-python-2.0.13-1.fc7 selinux-policy-2.6.4-21.fc7
Daniel J Walsh:
rpm -qa *policy* libse* libsepol-2.0.4-1.fc8 checkpolicy-debuginfo-2.0.3-1.fc8 selinux-policy-3.0.1-3.fc8 libsemanage-debuginfo-2.0.3-1.fc7 policycoreutils-2.0.22-3.fc8 libselinux-python-2.0.22-1.fc8 libsemanage-devel-2.0.3-3.fc8 libsepol-devel-2.0.4-1.fc8 libsexy-0.1.11-1.fc7 policycoreutils-gui-2.0.22-3.fc8 libsepol-debuginfo-2.0.3-1.fc7 policycoreutils-debuginfo-2.0.19-4.fc8 libselinux-devel-2.0.22-1.fc8 selinux-policy-targeted-3.0.1-3.fc8 checkpolicy-2.0.3-2.fc8 libselinux-debuginfo-2.0.21-2.fc8 selinux-policy-devel-3.0.1-3.fc8 libselinux-2.0.22-1.fc8 libsemanage-2.0.3-3.fc8 policycoreutils-newrole-2.0.22-3.fc8
I think some could be removed from that list as not usually installed (debug), or needed (devel & utils) leaving, at most:
libsepol-2.0.4-1.fc8 selinux-policy-3.0.1-3.fc8 policycoreutils-2.0.22-3.fc8 libselinux-python-2.0.22-1.fc8 policycoreutils-gui-2.0.22-3.fc8 selinux-policy-targeted-3.0.1-3.fc8 checkpolicy-2.0.3-2.fc8 libselinux-2.0.22-1.fc8 libsemanage-2.0.3-3.fc8 policycoreutils-newrole-2.0.22-3.fc8
Though you've got fc8 packages, and that's a bit of ahead of things. You could probably remove a few more. Some being for you to twiddle some of the settings, not needed for the system to just run.
On Thu June 28 2007 13:32:01 Tim wrote:
I think some could be removed from that list as not usually installed (debug), or needed (devel & utils) leaving, at most:
I think mr walsh needs all these him being the selinux maintainer an'all :-)
...dex
Tim:
I think some could be removed from that list as not usually installed (debug), or needed (devel & utils) leaving, at most:
dexter:
I think mr walsh needs all these him being the selinux maintainer an'all :-)
Well, that would be a special case... I was thinking more in general, for those following the "I don't like it" chain of thought. ;-)
Tim wrote:
On Wed, 2007-06-27 at 11:26 +0000, Tom Horsley wrote:
P.P.S. Trying to remove everything except libselinux doesn't work, it still insists on removing every rpm on the system. Trying again with all the other lib-whatever packages associated with selinux give the same results. It acts a lot like everything depends on every selinux package.
There's a bit of a circular dependency. Applications *have* to be SELinux aware so that files are created with proper contexts for when SELinux is used.
Very few applications need to be explicitly SELinux aware and those are the core system application that manage policy. Rest of them automatically get a context based on a central policy.
Rahul