[PATCH] Allow selinux=? and enforcing=? kernel flags to be controlled
This is a pretty uncontroversial patch which just allows the selinux=? and enforcing=? flags on the kernel command line to be controlled. Currently libguestfs unconditionally passes selinux=0. By default this patch does the same thing, but allows programs to enable SELinux in the kernel and/or set it to enforcing mode. Rich. -- Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://et.redhat.com/~rjones/virt-top
On 12/08/09 16:22, Richard W.M. Jones wrote:
This is a pretty uncontroversial patch which just allows the selinux=? and enforcing=? flags on the kernel command line to be controlled.
Currently libguestfs unconditionally passes selinux=0. By default this patch does the same thing, but allows programs to enable SELinux in the kernel and/or set it to enforcing mode.
Patch looks ok except that we shouldn't include the enforcing flag. I can't conceive of any reason we'd want SELinux in enforcing mode in the appliance. If selinux=1, then assume enforcing=0. Matt -- Matthew Booth, RHCA, RHCSS Red Hat Engineering, Virtualisation Team M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490
On Wed, Aug 12, 2009 at 04:32:48PM +0100, Matthew Booth wrote:
On 12/08/09 16:22, Richard W.M. Jones wrote:
This is a pretty uncontroversial patch which just allows the selinux=? and enforcing=? flags on the kernel command line to be controlled.
Currently libguestfs unconditionally passes selinux=0. By default this patch does the same thing, but allows programs to enable SELinux in the kernel and/or set it to enforcing mode.
Patch looks ok except that we shouldn't include the enforcing flag. I can't conceive of any reason we'd want SELinux in enforcing mode in the appliance. If selinux=1, then assume enforcing=0.
Does it do any harm (now that I've written the code anyway)? Rich. -- Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://et.redhat.com/~rjones/virt-top
On 12/08/09 16:48, Richard W.M. Jones wrote:
On Wed, Aug 12, 2009 at 04:32:48PM +0100, Matthew Booth wrote:
On 12/08/09 16:22, Richard W.M. Jones wrote:
This is a pretty uncontroversial patch which just allows the selinux=? and enforcing=? flags on the kernel command line to be controlled.
Currently libguestfs unconditionally passes selinux=0. By default this patch does the same thing, but allows programs to enable SELinux in the kernel and/or set it to enforcing mode. Patch looks ok except that we shouldn't include the enforcing flag. I can't conceive of any reason we'd want SELinux in enforcing mode in the appliance. If selinux=1, then assume enforcing=0.
Does it do any harm (now that I've written the code anyway)?
It adds another command line option to be maintained and documented. Matt -- Matthew Booth, RHCA, RHCSS Red Hat Engineering, Virtualisation Team M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490
On Wed, Aug 12, 2009 at 04:48:03PM +0100, Richard W.M. Jones wrote:
On Wed, Aug 12, 2009 at 04:32:48PM +0100, Matthew Booth wrote:
On 12/08/09 16:22, Richard W.M. Jones wrote:
This is a pretty uncontroversial patch which just allows the selinux=? and enforcing=? flags on the kernel command line to be controlled.
Currently libguestfs unconditionally passes selinux=0. By default this patch does the same thing, but allows programs to enable SELinux in the kernel and/or set it to enforcing mode.
Patch looks ok except that we shouldn't include the enforcing flag. I can't conceive of any reason we'd want SELinux in enforcing mode in the appliance. If selinux=1, then assume enforcing=0.
Does it do any harm (now that I've written the code anyway)?
OK, I'm going to push this _without_ the enforcing part (except that if selinux=1 it will always set enforcing=0). Rich. -- Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones Read my programming blog: http://rwmj.wordpress.com Fedora now supports 75 OCaml packages (the OPEN alternative to F#) http://cocan.org/getting_started_with_ocaml_on_red_hat_and_fedora
participants (2)
-
Matthew Booth -
Richard W.M. Jones