Re: [gentoo-hardened] Feedback on article recommending Gentoo for SELinux

[Sven Vermeulen <sven.vermeulen@siphos.be>]

On Mon, Jul 13, 2015 at 1:31 PM, Jason Zaman <perfinion@gentoo.org> wrote:
> Overall a good article. One thing which I would also point out together
> with the move to CIL is that there is now no "base" module. In the 2.3
> and earlier userlands, all the important things were in "base.pp" and
> then other things were added separately as modules. One of the reasons
> why modifying ports works in the 2.4 userland is that there is no more
> base, it is treated just like any other module now so the limitations of
> eg ports must be in base no longer apply.

I'd be careful with the "no base". This heavily depends on how the
userland utilities will work with the CIL, which isn't fully clarified
yet.

> Secondly, related to "poor support for preserving local changes across
> system updates". The tools now have the concept of priority so users can
> easy completely replace a distro-provided module at a higher priority
> (semodule -X 900 -i foo.pp). I haven't (yet) updated our selinux eclass
> to install at a lower priority but will hopefully do that soon.

We work with the default 400 (100 is for the migrated modules). Do you
see a reason why we have to explicitly support a particular priority
in our eclass?

Wkr,
  Sven Vermeulen