[gentoo-hardened] Re: Status new selinux reference policy

[Kevin]

Petre Rodan wrote:
> hi Chris,
>
> [..]
>> Courier, dante, jabber and snort are done.
>
> great news.
>
>> I believe a debian guy is doing a openvpn policy.  I'll see if I
>> can get the remaining policies converted over this weekend.
>
> I talked with Erich Schubert and he said that the openvpn policy is low priority for him, so I will do that one. It is almost done actually.
>

I hope I'm not seeming impatient by asking these questions, but in
preparing to post to this list, I noticed this thread and this is very
much like what I would have posted so I'll follow up instead.

Also, there's one issue that I'm not quite understanding in this thread,
though, and I've asked the question in a number of different phrasings
(marked with [] ) because I'm having difficulty figuring out how to
express the question succinctly.

Three weeks have now passed since the last post to this thread, so
please pardon me if I politely ask:

Where do the issues raised by this thread stand now?

pebenito writes that, "Courier, dante, jabber and snort are done," so
that leaves:

-The Gentoo SELinux reference policy itself [In the context of Gentoo,
exactly what is this?  A Gentoo package?  A collection of packages?  A
collection of files that each package owns?  other?]

-Petre Rodan wrote: "use what we have now in the stable branch please"
[So is that a package in portage then?]  Sorry if I'm being dense here.

-How far along is the work to migrate to the reference policy?

-pebenito mentions, "I had planned on a test release of refpolicy for
Gentoo right now,"...  [Is that (refpolicy) a gentoo package?]  I don't
see anything like it in portage, but perhaps that's because it's just
not in there yet.

-other policies not already addressed in the thread:
asterisk
clockspeed
ntop
openvpn
qmail

And finally, [how do I make use of these policies if they are all done?]

Pardon me for the newbie-ness of this additional question, but: [when
pebenito says, "Courier, dante, jabber and snort are done," what exactly
does that mean?  Is there a gentoo package containing a policy for
courier-imap or jabber-server or dante or snort?  Or is the policy for
(say) jabber-server just a file (or a set of files) that is incorporated
into the jabber-server package when the selinux USE flag is set?  (or
other?).]

Being a newbie to SELinux, I think I'm missing something about how
SELinux policies are incorporated into Gentoo.

I read the bug report mentioned in this thread and the
http://serefpolicy.sourceforge.net/ pointer referenced therein, but not
knowing exactly how these policies are incorporated into Gentoo I feel
like I'm missing a piece of the puzzle.

Thanks.

-Kevin

PS. If any of these are faqs, I welcome a redirection to the appropriate
source of answers.
-- 
gentoo-hardened@g.o mailing list