[gentoo-hardened] RFC - SELinux module documentation

[Sven Vermeulen]

Hi all,

One of the "difficulties" of working with SELinux is that the policy that is
pushed by default is tailored towards a default installation using
unmodified locations and such.

The moment users start configuring their system (different PORTDIR for
Portage, other DocumentRoot for Apache, etc.) which, with Gentoo, is
considered common practice, people need to start configuring and tweaking
SELinux as well.

I've been thinking about how to proceed on this and came up with the idea of
having module information. An example for Apache can be found at
http://xrl.us/bkqkkp (image at http://xrl.us/bkqkk5 since g.o.g.o doesn't
use the regular location syntax for embedded files), another one is
available for Portage too (http://xrl.us/bkqkk7). Images are created through
docs.google.com and created to SVG (also in git), but converted to PNG for
rendering purposes (only <img .../> tag is supported).

Such a module information gives a general overview of the module structure
(picture with allowed domain transitions plus overview of the domains and
files) and then talks about hwo to use the module to suit your needs (file
contexts, booleans, semanage commands where needed, ...)

I have chosen separate guides for each module due to the large amount of
information. Another option was to create a huge book, but I think this is
easier as it will provide a simple URL syntax
(http://www.gentoo.org/proj/en/selinux/modules/MODULENAME.xml) instead of
the handbook one.

Comments, feedback, ... always appreciated.

Wkr,
	Sven Vermeulen