Red Hat Bugzilla – Bug 119573
SELinux FAQ - [summarize FAQ change or addition]
Last modified: 2007-04-18 13:05:02 EDT
Description of change/FAQ addition. If a change, include the original
text first, then the changed text:
The FAQ says that a policy update automatically loads the new policy.
I don't think that this is presently true, although I agree that it
is the right thing to do. So either the policy package or the FAQ
need to be changed for consistency.
Version-Release of FAQ (found on
for example selinux-faq-1.0 (2004-03-29-T16:20-0800)
Is this a non-trival change to policy? Otherwise, we need to fix the
documentation, even if it's for only a short time; I assume there will
be new policy updates.
Dan made the change to the policy package after I submitted
this entry, so it now reloads policy automatically. So this
bug can be closed.
A couple lingering items to note:
At times, it won't be possible to automatically reload the policy on
a running system, so the automatic reload may need to be disabled for
certain policy updates. Examples:
1) Policy version change. In this case, the kernel needs to be
updated and rebooted before you can load the new policy. Dependencies
can ensure that kernel is updated first, but not that it is booted.
2) Major policy change that removes or radically changes domains
and requires a reboot to get system daemons into the right domain.
Also, although the policy RPM has been updated to reload policy,
I don't think it is presently relabeling the filesystem upon a policy
update. So if you change file_contexts, that won't get applied
automatically. I'm not sure what the right solution is there, e.g.
should we be doing a relabel from the policy package or should rpm
automatically rebuild any affected packages when we change
file_contexts so that the normal package update will handle the new
(adding blocker bug 118757 back in for tracking purposes)
How are we going to inform users when they need to do something
manually? Similarly for all cases, how much can we do automatically?
How many different scenarios are we supporting?
For the moment, this issue is resolved with respect to the accuracy of
the FAQ. I'll close to NOTABUG (it was a policy bug, if anything), we
can reopen if the situation changes (wrt Stephen's above comments) or
we can open a new bug to change the FAQ details.