"Simon de Vlieger" <[email protected]> writes: > On Thu, Oct 15, 2026, at 10:27 AM, Petr Lautrbach via devel wrote: > >> It will be part of selinux 3.12 which should be released until the end >> of the year. >> >> It's on my plan to adopt selinux-policy packaging to ship read only >> policy store in /usr/lib/selinux. > > This is cool news Petr, do you think this will include changes to > packages that ship their own selinux policies (e.g. cockpit-selinux) > to also be able to install into `/usr`? >
This is something we need to figure out. For a standard system, it looks like we could simply change selinux-policy-targeted to ship module store files in /usr/lib/selinux/targeted/active instead of /var/lib/selinux/targeted/active.-selinux packages following SELinux Independent Policy [1] would need to be updated %selinux_modules_... macros and also update all of them to ship files in /usr/lib/selinux/targeted/active/modules/200 Standard systems triggers policy rebuild, which is necessary, every time a policy module is installed. We need to figure out how to handle this in atomic systems. Anyway, the current plan is to start building selinux userspace and selinux-policy with this feature in a copr repo when 3.12-rc1 is released and use it as a place for experiments. And when we have a clear idea how, we can start work on Fedora change. [1] https://fedoraproject.org/wiki/SELinux/IndependentPolicy Petr > If so that would open the door to finally being able to ship packages > with their own policies as systemd sysexts (currently we have to copy > their policies into the distro policy if we want to do this) :) > >> I personally don't see a reason to switch the default to /etc for >> standard system at this moment. Atomic distros already uses >> store-root=/etc but arguably selinux module store suits better to >> /var/lib than to /etc given that it consists of binary module cache used >> for building selinux policy. > > Same (provided the read-only store is in /usr) it feels to me that the > mutable bits could just live in /var. > > Regards, > > Simon > -- > _______________________________________________ > devel mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/[email protected] > Do not reply to spam, report it: > https://forge.fedoraproject.org/infra/tickets/issues/new -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
