Re: [gentoo-hardened] Cleanup of sec-policy (old ebuilds)

[Anthony G. Basile]

On 02/27/2011 08:23 AM, Sven Vermeulen wrote:
> Hi all,
>
> The current sec-policy category contains many old ebuilds for old and
> obsoleted SELinux policies. In my opinion, it would be better if we purge
> them so that only those based on the 20101213 refpolicy remain (and for
> those, only a limited set).
>
> My general idea on purging ebuilds is to drop all stable ebuilds except the
> latest stable, and to drop all ~arch ebuilds except the last two or so.
>
> I know the current stable ones might not even function well, but dropping
> all stables might result in dependencies being broken for existing users
> (even if they run in permissive mode, it would cause Portage to fail
> installing master packages that depend on a SELinux policy...
>
> I don't mind drafting a script or patch that does this, but if a developer
> sais he doesn't need a patch it'll save me quite some time :-) Also, if you
> just prefer a list of ebuilds to keep (for each package) that's fine too,
> but in that case don't forget to clean the files/ folder too.
>
> Wkr,
> 	Sven Vermeulen

Since the selinux policies come as a set with the same date as a version
number, wouldn't it be better to, say, remove all the 20080525 first.
Fix any brokenness, then deal with 20090730, etc until we've removed the
sets we want gone?

Since selinux is out of date, I suspect a lot of users (like me) run
~arch for the policies.  I'm not sure keeping/removing on the basis of
stable/unstable works.

I don't even know what the policy is for stabilization of sec-policy/*

-- 
Anthony G. Basile, Ph.D.
Gentoo Developer