On Thu, Oct 15, 2026, at 10:27 AM, Petr Lautrbach via devel wrote: > It will be part of selinux 3.12 which should be released until the end > of the year. > > It's on my plan to adopt selinux-policy packaging to ship read only > policy store in /usr/lib/selinux.
This is cool news Petr, do you think this will include changes to packages that ship their own selinux policies (e.g. cockpit-selinux) to also be able to install into `/usr`? If so that would open the door to finally being able to ship packages with their own policies as systemd sysexts (currently we have to copy their policies into the distro policy if we want to do this) :) > I personally don't see a reason to switch the default to /etc for > standard system at this moment. Atomic distros already uses > store-root=/etc but arguably selinux module store suits better to > /var/lib than to /etc given that it consists of binary module cache used > for building selinux policy. Same (provided the read-only store is in /usr) it feels to me that the mutable bits could just live in /var. Regards, Simon -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
