From: Tom Lane <tgl@sss.pgh.pa.us>
To: Mike Palmiotto <mike.palmiotto@crunchydata.com>
Cc: pgsql-hackers@lists.postgresql.org, Joe Conway <mail@joeconway.com>
Subject: Re: sepgsql seems rather thoroughly broken on Fedora 30
Date: Thu, 25 Jul 2019 11:09:04 -0400
Message-ID: <22118.1564067344@sss.pgh.pa.us> (raw)
In-Reply-To: <CAMN686F+tpUUW1B=9nF-CiNRrEByBPmK-k2Qwp+Fh8G+EVMhug@mail.gmail.com>
References: <23856.1563381159@sss.pgh.pa.us>
<CAMN686Ew55FmGAZMsin_r2GKOpTwNwGS2PJ2v+KX8jO2yU3Sqw@mail.gmail.com>
<25538.1563549575@sss.pgh.pa.us>
<CAMN686H0bby=GXfmF2ykB_CntyvM5YVO6BjEg5-e1+Ee1uJXeA@mail.gmail.com>
<5847.1563568165@sss.pgh.pa.us>
<CAMN686F+tpUUW1B=9nF-CiNRrEByBPmK-k2Qwp+Fh8G+EVMhug@mail.gmail.com>
Mike Palmiotto <mike.palmiotto@crunchydata.com> writes:
> On Fri, Jul 19, 2019 at 4:29 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> I can confirm that the 0001 patch fixes things on my Fedora 30 box.
>> So that's good, though I don't know enough to evaluate it for style
>> or anything like that.
> I think the policy is in need of review/rewriting anyway. The proper
> thing to do would be to create a common template for all of the
> SELinux regtest user domains and create more of a hierarchical policy
> to reduce redundancy. If you want to wait for more formal policy
> updates, I can do that in my spare time. Otherwise, the patch I posted
> should work with the general style of this policy module.
Hearing no further comments, I went ahead and pushed 0001 (after
checking that it works on F28, which is the oldest Fedora version
I have at hand right now). Stylistic improvements to the script
are fine, but let's get the bug fixed for now.
BTW, I noticed that the documentation about how to run the tests
is a bit stale as well --- for instance, it says to use
$ sudo semodule -u sepgsql-regtest.pp
but that slaps your wrist:
The --upgrade option is deprecated. Use --install instead.
So if anyone does feel like polishing things in this area, some doc
review seems indicated.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, mike.palmiotto@crunchydata.com, mail@joeconway.com
Subject: Re: sepgsql seems rather thoroughly broken on Fedora 30
In-Reply-To: <22118.1564067344@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox