On Mon, Jul 13, 2026 at 09:20:14AM +0100, Simon McVittie wrote:
> On Mon, 13 Jul 2026 at 16:58:28 +1000, Russell Coker wrote:
> > The package selinux-utils is depended on by selinux-policy-default, so it
> > will
> > be dragged in by every functional SE Linux system
>
> On https://salsa.debian.org/selinux-team/libselinux/-/merge_requests/14,
> Adrian argued that "On an embedded system one does often provision policy
> through other means" (presumably meaning that such systems would not
> necessarily have selinux-policy-default installed).
> "Using selinux means instealling policy, admin tools, etc."
"On an embedded system one does often provision policy through other
means and does not install admin tools."
The problem with abstract broad claims like what Luca did is that they
are not true in all cases, e.g. there might be no need for checkpolicy
on a target.
> Is that a use-case that
> is supported by the SE Linux team in Debian?
>
> If yes, is there a package that is smaller than selinux-policy-default, but
> *does* need to be pulled in by every functional SE Linux system? I'm hoping
> that one of selinux-basics, policycoreutils or selinux-utils has that role.
>
> If all working SE Linux systems will have one of those packages, then the
> same reasoning says that the Recommends isn't necessary.
IMHO the reasoning that what is effectively a mkdir in libselinux1 would
be a problem is not convincing, my argument in #1141909 is that tmpfiles
is functionality that should be (and de facto basically already is) in
the essential set.
> smcv
cu
Adrian
BTW: I wonder why selinux_compile_fcontexts is in libselinux1 and not in
selinux-utils, but that's also not something that is a problem.
