Description of change/FAQ addition. If a change, include the original text first, then the changed text: The FAQ says that a policy update automatically loads the new policy. I don't think that this is presently true, although I agree that it is the right thing to do. So either the policy package or the FAQ need to be changed for consistency. Version-Release of FAQ (found on http://people.redhat.com/kwade/fedora-docs/selinux-faq-en/ln-legalnotice.html): for example selinux-faq-1.0 (2004-03-29-T16:20-0800)
Is this a non-trival change to policy? Otherwise, we need to fix the documentation, even if it's for only a short time; I assume there will be new policy updates.
Dan made the change to the policy package after I submitted this entry, so it now reloads policy automatically. So this bug can be closed.
A couple lingering items to note: At times, it won't be possible to automatically reload the policy on a running system, so the automatic reload may need to be disabled for certain policy updates. Examples: 1) Policy version change. In this case, the kernel needs to be updated and rebooted before you can load the new policy. Dependencies can ensure that kernel is updated first, but not that it is booted. 2) Major policy change that removes or radically changes domains and requires a reboot to get system daemons into the right domain. Also, although the policy RPM has been updated to reload policy, I don't think it is presently relabeling the filesystem upon a policy update. So if you change file_contexts, that won't get applied automatically. I'm not sure what the right solution is there, e.g. should we be doing a relabel from the policy package or should rpm automatically rebuild any affected packages when we change file_contexts so that the normal package update will handle the new file contexts?
(adding blocker bug 118757 back in for tracking purposes) How are we going to inform users when they need to do something manually? Similarly for all cases, how much can we do automatically? How many different scenarios are we supporting? For the moment, this issue is resolved with respect to the accuracy of the FAQ. I'll close to NOTABUG (it was a policy bug, if anything), we can reopen if the situation changes (wrt Stephen's above comments) or we can open a new bug to change the FAQ details.