Re: [gentoo-hardened] Feedback on article recommending Gentoo for SELinux

[Jason Zaman]

On Sun, Jul 12, 2015 at 04:46:03PM -0700, S. Lockwood-Childs wrote:
> I'd appreciate feedback on a blog-style article[1] talking about
> how CIL is going to improve SELinux policy maintenance, and in
> particular, the last section where I try to point out how good Gentoo
> is for experimenting with SELinux technologies. The article is
> maintained as an rst file in github[2], so corrections/additions
> could be submitted as a pull request if desired (though plain old
> mailing list replies are equally welcome).
>
> [1] http://vctlabs.com/posts/2015/Jul/12/selinux_cil/
> [2] https://github.com/VCTLabs/vct-web/blob/master/content/articles/selinux_cil.rst

Hi,

Overall a good article. One thing which I would also point out together
with the move to CIL is that there is now no "base" module. In the 2.3
and earlier userlands, all the important things were in "base.pp" and
then other things were added separately as modules. One of the reasons
why modifying ports works in the 2.4 userland is that there is no more
base, it is treated just like any other module now so the limitations of
eg ports must be in base no longer apply.

Secondly, related to "poor support for preserving local changes across
system updates". The tools now have the concept of priority so users can
easy completely replace a distro-provided module at a higher priority
(semodule -X 900 -i foo.pp). I haven't (yet) updated our selinux eclass
to install at a lower priority but will hopefully do that soon.

Not sure if you are aware of it, but there is also a project to write a
direct refpol -> cil compiler without going via .pp[1]. It looks like it
has stagnated for a while but it will hopefully make the generated cil
files a little less ugly than they currently are.
[1]: https://bitbucket.org/jwcarter/fpp.git

-- Jason