Am Do 31 Okt 2013 11:29:32 CET schrieb Jelle van der Waa:
On 10/31/13 at 09:36am, Allan McRae wrote:
On 31/10/13 09:36, Timothée Ravier wrote:
On 29/10/2013 01:21, Allan McRae wrote:
I'd suggest that someone maintains an unofficial repo with all the packages required to set this up to prove the work required for continual maintenance of this has been done. Then requests could be made to (e.g.) add support to the kernel, providing full details of what is required and if it has any effect on those not using SELinux.
Hi,
I've had this on my TODO list for a while but never got to finish it up to the point of having a really functional system as it is quite time consuming (especially the SELinux policy fixing part).
But I should have some time for it now so I'll try to make those packages.
Impact for non-SELinux users should be rather minimal: * kernel: TOMOYO is already enabled and need explicit boot parameter to operate and so will SELinux once enabled. No major changes here except for a slightly bigger kernel. * userspace: only a very restricted set of packages needs tweaks, but it won't impact performance for non-SELinux users. No major changes here except for slightly bigger packages.
Only packagers will be impacted as there are still some patches needed and this could slow down 'core packages' updates when issues arise. But fixes usually comes quite quickly as both Fedora and Gentoo maintain packages with SELinux support.
Requiring patches not accepted upstream is an immediate blocker.
I see a couple of issues that will also have to be resolved for SELinux on Arch to be usable: * It needs some support in pacman, otherwise package updates will be painful;
I'm interested as a pacman developer what support would be needed, but that too is a likely blocker.
* It needs a proper policy tuned for Arch Linux packages. Filesystem hierarchy differences between Fedora and Arch will prevent us from just applying the Fedora policy to Arch; * Performance comparisons between no-SELinux and disabled-SELinux installations to make sure the impact is minimal.
Cheers,
Tim
Although I'm not a fan of SELinux, it would be nice if there was a list ( wiki article ) which lists all patches we need to apply on our packages. ( Who providers these patches btw. ) And which policy files we need to ship with our packages
This wiki page already exists [1]. It mentions the patched packages are available in the AUR. I see no problem if someone wants to provide an unofficial binary repository for them. And as mentioned by Pablo Lezaeta, there exists a blogpost about arch with selinux [2] which is also referenced in the wiki. [1]: https://wiki.archlinux.org/index.php/SELinux [2]: http://www.jamesthebard.net/site/archlinux-selinux-and-you-a-trip-down-the-r...