Hi,

With the userspace 2.4, the policy store has moved from
/etc/selinux/<policy_name> to /var/lib/selinux/<policy_name> (the format
of the store has also changed).

The semanage-utils package contains a script to do that, we should see
if we are using it (it uses python) or if we are doing the migration
manually.

The maintainer script should also be updated to use the new location to
install the modules after the initial migration. Should we use semodule
again? We should also install these modules with the correct priority.

Cheers,

Laurent Bigonville

clone 805492 -1
retitle -1 refpolicy: Migrate existing store to new store format on upgrade
severity -1 wishlist
tag 805492 + help
thanks

Hi,

So I think we should split this in two issue:

1) make the maintainer script work and install the module in the new store
2) migrate the existing store, for this we could maybe just add
something in the release notes

For the 1st point, IMHO, the easiest would be to do like fedora and
install the modules directly in the /var/lib/selinux/<policy>/100 store
instead of copying/loading them at installation time. We could make it
clear that everything installed in the priority 100 is something the
package own that that could removed on upgrade. At installation time we
would just need to call semodule -B to build and reload the policy.

Any thoughts about installing stuffs like that directly in
/var/lib/selinux? Any other idea? Should we still install the .pp in
/usr/share/selinux if we are doing it like that?

Cheers,

Laurent Bigonville