Skip to contentSkip to conversation

blueman contrib policy

PATCH New Miroslav Grepl 3 participants 9 messages Jun 26, 2012 – Jul 10, 2012 1 message not in the archive

lore
Share & tools
lore
#1 lore raw

PATCH 1/1 blueman contrib policy

On Tue, 2012-06-26 at 23:09 +0200, Miroslav Grepl wrote:

There is a significant difference between the way reference policy implemented auth_use_nsswitch and the way fedora implemented it.

This leads me to believe that, since this policy relies on auth_use_nsswitch, it should probably be modified to reflect these changes between fedora's and refpolicy's auth_use_nsswitch()

Some other minor comments:

1. files dont need to file transition from var_lib_t to blueman_var_lib_t; only directories. The files are created inside these directories as per file context specification:

/var/lib/blueman(/.*)?gen_context(system_u:object_r:blueman_var_lib_t,s0)

2. files_read_etc_files(blueman_t) is redundant (it is already included with auth_use_nsswitch()

Quoted 13 lines

A new policy for blueman-mechanism from Fedora contrib repo.
(git://git.fedorahosted.org/selinux-policy.git)

Description :
Blueman is a tool to use Bluetooth devices.

Patch:
http://mgrepl.fedorapeople.org/SELinux/F18/contrib_blueman.patch

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

author
#2 lore raw

PATCH 1/1 blueman contrib policy

Quoted 8 lines · Dominick Grift

On Tue, 2012-06-26 at 23:09 +0200, Miroslav Grepl wrote:

There is a significant difference between the way reference policy implemented auth_use_nsswitch and the way fedora implemented it.

This leads me to believe that, since this policy relies on auth_use_nsswitch, it should probably be modified to reflect these changes between fedora's and refpolicy's auth_use_nsswitch()

You could say it about lot of policies which are in the contrib repo.

Let's discuss it.

Quoted 31 lines

Some other minor comments:

1. files dont need to file transition from var_lib_t to blueman_var_lib_t; only directories. The files are created inside these directories as per file context specification:

/var/lib/blueman(/.*)?gen_context(system_u:object_r:blueman_var_lib_t,s0)

2. files_read_etc_files(blueman_t) is redundant (it is already included with auth_use_nsswitch()

Quoted 6 lines

A new policy for blueman-mechanism from Fedora contrib repo.
(git://git.fedorahosted.org/selinux-policy.git)

Description :
Blueman is a tool to use Bluetooth devices.

Quoted 7 lines

Patch:
http://mgrepl.fedorapeople.org/SELinux/F18/contrib_blueman.patch

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

#3 lore raw

PATCH 1/1 blueman contrib policy

Quoted 10 lines · Miroslav Grepl
Quoted 8 lines · Dominick Grift

On Tue, 2012-06-26 at 23:09 +0200, Miroslav Grepl wrote:

There is a significant difference between the way reference policy implemented auth_use_nsswitch and the way fedora implemented it.

This leads me to believe that, since this policy relies on auth_use_nsswitch, it should probably be modified to reflect these changes between fedora's and refpolicy's auth_use_nsswitch()

You could say it about lot of policies which are in the contrib repo.

Not quite but there may be some that slipped the cracks. since fedora's auth_use_nsswitch() implementation underwent a huge change not many new modules have been upstreamed as far as i know.

So i dont think this is true, although in some cases i may be wrong.

Quoted 35 lines

Let's discuss it.

Quoted 31 lines

Some other minor comments:

1. files dont need to file transition from var_lib_t to blueman_var_lib_t; only directories. The files are created inside these directories as per file context specification:

/var/lib/blueman(/.*)?gen_context(system_u:object_r:blueman_var_lib_t,s0)

2. files_read_etc_files(blueman_t) is redundant (it is already included with auth_use_nsswitch()

Quoted 6 lines

A new policy for blueman-mechanism from Fedora contrib repo.
(git://git.fedorahosted.org/selinux-policy.git)

Description :
Blueman is a tool to use Bluetooth devices.

Quoted 7 lines

Patch:
http://mgrepl.fedorapeople.org/SELinux/F18/contrib_blueman.patch

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

author
#4 lore raw

PATCH 1/1 blueman contrib policy

In reply to Miroslav Grepl
Quoted 6 lines · Miroslav Grepl
Quoted 5 lines · Dominick Grift

On Tue, 2012-06-26 at 23:09 +0200, Miroslav Grepl wrote:

There is a significant difference between the way reference policy implemented auth_use_nsswitch and the way fedora implemented it.

Quoted 6 lines
Quoted 3 lines

This leads me to believe that, since this policy relies on auth_use_nsswitch, it should probably be modified to reflect these changes between fedora's and refpolicy's auth_use_nsswitch()

You could say it about lot of policies which are in the contrib repo.

Let's discuss it.

Also I don't see this big differences. We use nsswitch_domain attribute now which will also submit as a patch.

Quoted 35 lines
Quoted 22 lines

Some other minor comments:

1. files dont need to file transition from var_lib_t to blueman_var_lib_t; only directories. The files are created inside these directories as per file context specification:

/var/lib/blueman(/.*)?gen_context(system_u:object_r:blueman_var_lib_t,s0)

2. files_read_etc_files(blueman_t) is redundant (it is already included with auth_use_nsswitch()

Quoted 9 lines

A new policy for blueman-mechanism from Fedora contrib repo.
(git://git.fedorahosted.org/selinux-policy.git)

Description :
Blueman is a tool to use Bluetooth devices.

Patch:
http://mgrepl.fedorapeople.org/SELinux/F18/contrib_blueman.patch

Quoted 8 lines
Quoted 4 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

#5 lore raw

PATCH 1/1 blueman contrib policy

Quoted 7 lines · Miroslav Grepl
Quoted 6 lines · Miroslav Grepl
Quoted 5 lines · Dominick Grift

On Tue, 2012-06-26 at 23:09 +0200, Miroslav Grepl wrote:

There is a significant difference between the way reference policy implemented auth_use_nsswitch and the way fedora implemented it.

Quoted 8 lines
Quoted 6 lines
Quoted 3 lines

This leads me to believe that, since this policy relies on auth_use_nsswitch, it should probably be modified to reflect these changes between fedora's and refpolicy's auth_use_nsswitch()

You could say it about lot of policies which are in the contrib repo.

Let's discuss it.

Also I don't see this big differences. We use nsswitch_domain attribute now which will also submit as a patch.

Hmm yes you are right, there are some changes but its not as big as i thought.

A message that is not in the archive (sent off-list or not yet received): [email protected]

author
#7 lore raw

PATCH 1/1 blueman contrib policy

Quoted 7 lines · Christopher J. PeBenito
Quoted 6 lines · Miroslav Grepl
Quoted 5 lines · Dominick Grift

On Tue, 2012-06-26 at 23:09 +0200, Miroslav Grepl wrote:

There is a significant difference between the way reference policy implemented auth_use_nsswitch and the way fedora implemented it.

Quoted 8 lines
Quoted 6 lines
Quoted 3 lines

This leads me to believe that, since this policy relies on auth_use_nsswitch, it should probably be modified to reflect these changes between fedora's and refpolicy's auth_use_nsswitch()

You could say it about lot of policies which are in the contrib repo.

Let's discuss it.

Not surprising. Last time I think anything has been upstreamed from Fedora/Red Hat was in January.

We did al lot of work to switch our structure to reflect upstream structure to make patches much more easier. Also these changes related to auth_use_nsswitch are not so big. We use nsswitch_domain attribute. Basically we now use more attributes to shrink the policy .

I believe now it will be easier to add our patches.

Regards,
Miroslav

author
#8 lore raw

PATCH 1/1 blueman contrib policy

In reply to Miroslav Grepl
Quoted 6 lines · Miroslav Grepl

A new policy for blueman-mechanism from Fedora contrib repo.
(git://git.fedorahosted.org/selinux-policy.git)

Description :
Blueman is a tool to use Bluetooth devices.

Quoted 7 lines

Patch:
http://mgrepl.fedorapeople.org/SELinux/F18/contrib_blueman.patch

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Updated.

#9 lore raw

PATCH 1/1 blueman contrib policy

Quoted 11 lines · Miroslav Grepl
Quoted 9 lines · Miroslav Grepl

A new policy for blueman-mechanism from Fedora contrib repo.
(git://git.fedorahosted.org/selinux-policy.git)

Description :
Blueman is a tool to use Bluetooth devices.

Patch:
http://mgrepl.fedorapeople.org/SELinux/F18/contrib_blueman.patch

Updated.

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com