[2019-05-16 11:43] Laurent Bigonville <[email protected]>
> On Thu, 16 May 2019 08:54:43 +0000 Dmitry Bogatov <[email protected]>
> wrote:
> >
> > From 7f6242e5f3d893e90b3ed44fb09abe5983c2d49a Mon Sep 17 00:00:00 2001
> > From: Dmitry Bogatov <[email protected]>
> > Date: Wed, 15 May 2019 12:10:13 +0000
> > Subject: [PATCH] init: delegate selinux operation to separate binary
> Can you please explain the rational behind this?
This way, /sbin/init is no longer linked aganist libselinux (and its
transitive dependencies).
If user need selinux initialization, she can install
/sbin/selinux-check separately.
> This looks like a bad idea to me. SELinux needs to be initialized as
> soon as possible during the boot otherwise this will call for issues.
As you may see, this patch does not change time during boot, when
selinux functions are called -- only moves them into child process.
> Was that discussed with anybody involved in SELinux in debian and/or
> upstream?
That is exactly place to start discussion. Luckily, Jesse is following
BTS, and I do not have to go through Savannah issue tracker.
PS. I removed -lselinux from INITLIBS in src/Makefile.
--
Note, that I send and fetch email in batch, once every 24 hours.
If matter is urgent, try https://t.me/kaction
--
