Neal Gompa <[email protected]> writes:
> On Thu, Oct 15, 2026 at 10:03 AM Barry Scott <[email protected]> wrote:
>>
>>
>>
>> On 15 Oct 2026, at 12:53, Vitaly Zaitsev via devel
>> <[email protected]> wrote:
>>
>> The /var/lib directory should always be used for system-wide configurations
>> provided as part of packages.
>>
>>
>> I thought that /var was for the user's database, logs etc.
>>
>> Not files from packages. Isn't that was /usr is for?
>>
>
> Well, SELinux has configuration (in /etc), policy database and cache
> (in /var), and policy data (historically split across /etc and /usr,
> now mostly in /usr with v3.12 of the userspace tools).
>
To be clear, 3.12 does not change default SELinux store location, it's
still in /var. But there's a possibility set read only module store in
semanage.conf:
ro-store-root
Specify a colon-separated list of additional, read-only module-store
roots to search after store-root when reading, e.g.
"/usr/lib/selinux". Only the active subtree of a listed root is
read; the sandbox, previous store, and lock files always live under
store-root. Module listing is the union across all roots, and a
module at the same priority and name under store-root shadows
one from a read-only root; installing at that priority overrides the
vendor module and removing the local copy unshadows it. semodule -r
on a module that exists only in a read-only root is refused (use -d
to disable it), as is semodule -e on a module that a read-only root
marks disabled. Unset by default, in which case only store-root is
searched and behavior is unchanged
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
