From: Tom Lane <tgl@sss.pgh.pa.us>
To: Mike Palmiotto <mike.palmiotto@crunchydata.com>
cc: pgsql-hackers@lists.postgresql.org, Joe Conway <mail@joeconway.com>
Subject: Re: sepgsql seems rather thoroughly broken on Fedora 30
In-reply-to: 
 <CAMN686F+tpUUW1B=9nF-CiNRrEByBPmK-k2Qwp+Fh8G+EVMhug@mail.gmail.com>
References: <23856.1563381159@sss.pgh.pa.us>
 <CAMN686Ew55FmGAZMsin_r2GKOpTwNwGS2PJ2v+KX8jO2yU3Sqw@mail.gmail.com>
 <25538.1563549575@sss.pgh.pa.us>
 <CAMN686H0bby=GXfmF2ykB_CntyvM5YVO6BjEg5-e1+Ee1uJXeA@mail.gmail.com>
 <5847.1563568165@sss.pgh.pa.us>
 <CAMN686F+tpUUW1B=9nF-CiNRrEByBPmK-k2Qwp+Fh8G+EVMhug@mail.gmail.com>
Comments: In-reply-to Mike Palmiotto <mike.palmiotto@crunchydata.com>
	message dated "Fri, 19 Jul 2019 16:49:44 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <22117.1564067344.1@sss.pgh.pa.us>
Date: Thu, 25 Jul 2019 11:09:04 -0400
Message-ID: <22118.1564067344@sss.pgh.pa.us>
Precedence: bulk

Mike Palmiotto <mike.palmiotto@crunchydata.com> writes:
> On Fri, Jul 19, 2019 at 4:29 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> I can confirm that the 0001 patch fixes things on my Fedora 30 box.
>> So that's good, though I don't know enough to evaluate it for style
>> or anything like that.

> I think the policy is in need of review/rewriting anyway. The proper
> thing to do would be to create a common template for all of the
> SELinux regtest user domains and create more of a hierarchical policy
> to reduce redundancy. If you want to wait for more formal policy
> updates, I can do that in my spare time. Otherwise, the patch I posted
> should work with the general style of this policy module.

Hearing no further comments, I went ahead and pushed 0001 (after
checking that it works on F28, which is the oldest Fedora version
I have at hand right now).  Stylistic improvements to the script
are fine, but let's get the bug fixed for now.

BTW, I noticed that the documentation about how to run the tests
is a bit stale as well --- for instance, it says to use

	$ sudo semodule -u sepgsql-regtest.pp

but that slaps your wrist:

	The --upgrade option is deprecated. Use --install instead.

So if anyone does feel like polishing things in this area, some doc
review seems indicated.

			regards, tom lane