Re: [gentoo-hardened] SELinux policy module packages

[Chris Richards]

On 02/12/2011 08:20 AM, Sven Vermeulen wrote:
> I rather not follow Gentoo's package names. I know it might make it easier
> to deduce which sec-policy/selinux-* packages need to be installed on a
> system, but this is a temporary situation - in the long term, we want all
> packages that have SELinux policies to have an optional (selinux) dependency
> against their sec-policy/selinux-* package. The downside would be that we
> need to either make duplicate packages for these tools that have policies
> within the same module (think the bootloader case) or use a different naming
> convention for those particular packages.

TBH, I really see nothing wrong with the naming convention we are using 
now, which (AFAIK) pretty much follows the upstream module naming 
convention (which I think is what you are proposing).  In all 
probability, it seems rather unlikely that there will be multiple 
selinux policy modules with the same file name, as the file name tends 
to reflect either the module name or its functionality (depending on 
what's included in the file), either of which will tend to constrain the 
range of both possible and likely names.

I also am not following the argument about 'make duplicate packages'?  
If a policy module ebuild can work for multiple different packages, that 
is fine.  We simply have an optional selinux dependency in each of the 
application ebuilds on that same selinux module.  If the module is 
already installed then the dependency is already satisfied.  If not, 
then we pull it in.  Or am I missing something?

I agree that the long-term goal should be to modify all packages that 
need to have an selinux module such that they have an optional selinux 
dependency.

As blueness has pointed out, renaming a bunch of packages is a PITA.  I 
really don't see that we get anything from doing so at this point, 
except a bunch of pain.

Later,
Chris