Continuous integration updates

Stephen C. Tweedie sct at redhat.com
Mon Oct 7 16:53:01 UTC 2013


Hi,

On Mon, 2013-10-07 at 10:34 -0400, Russell Doty wrote:

> The good news is that this approach increases the quality of our
> software. The bad news is that it makes it important to keep tests in
> sync with the software. Actually, that is good news - it prevents us
> from building up a huge technical debt in out of date tests.
> 
> It looks like SELinux is showing up a lot. This isn't a surprise;
> SELinux isn't that important for development. 

It's important not to defer the selinux work for too long, though, and
better to keep the policy up to date if possible rather than ignore it
and try to fix it all at once.

> However, we do have to
> ensure that OpenLMI works with SELinux in enforcing mode and that we
> don't have SELinux AVC denials.

Just a quick warning --- it's quite possible to get AVC denials in
permissive mode that are not present in enforcing, so it's better if
possible to run enforcing and fix the AVCs seen that way than to try to
fix everything in the policy in permissive mode.

(Enforcing mode can result in a series of operations being stopped at
the beginning with a single "dontaudit" denial, which won't appear in
the logs; run that in permissive mode and the initial dontaudit check
will succeed but subsequent operations will unexpectedly run and cause
additional AVCs.)

--Stephen




More information about the openlmi-devel mailing list