"Simon de Vlieger" <[email protected]> writes: > On Thu, Oct 15, 2026, at 2:08 AM, Jehu Marcos Herrera Puentes wrote: > >> # Summary >> >> Move the SELinux policy store (installed modules, local customizations >> and the compiled policy) from `/var/lib/selinux` to >> `/etc/selinux/<policy>/active` by setting `store-root = /etc/selinux` >> in the default `semanage.conf`. This brings every Fedora edition, spin >> and atomic variant to a single layout, matches the location already >> used on ostree-based systems such as Fedora Silverblue, and follows the >> migration that openSUSE completed in 2026. Existing systems are >> migrated automatically on upgrade. > > `libselinux` and `libsemanage` recently gained support to load policies > and contexts from `/usr` which would have my personal preference for the > location to load this from. Adjusted state can indeed move to `/etc` > (instead of `/var`) but I'd really like our *default* location to be in > `/usr` for the policies and contexts that are shipped with the system. > > Is this something to consider? It doesn't get mentioned in this proposal > at all from a quick scan. >
It will be part of selinux 3.12 which should be released until the end of the year. It's on my plan to adopt selinux-policy packaging to ship read only policy store in /usr/lib/selinux. I personally don't see a reason to switch the default to /etc for standard system at this moment. Atomic distros already uses store-root=/etc but arguably selinux module store suits better to /var/lib than to /etc given that it consists of binary module cache used for building selinux policy. Also I'd great if any of selinux policy maintainers were contacted before such system wide change was proposed. Petr -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
