containers / containers/selinuxd

RFC: use semodule --checksum and priorities instead of datastore

Open
#40 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
42
Forks
19
PR merge metrics
No merged PRs in 30d

Description

I probably miss some piece of the puzzle but it looks like all datastore functionality could be implemented using `semodule` utility or *libsemanage* library. Bellow are shell snippets describing how it could work.

* List()
`semodule -lfull | grep -E '^350 `

* Put() is not necessagy, it's automatically covered by `semodule -i ...`

* Get()
~~~
# semodule -lfull --checksum | grep -E '^350 ' | grep $policy
350 testpolicy cil sha256:0d682da9f705d4a44bad5151c59598f96a1839e10efe5f00b2bd16ba3c562676
~~~

This works on Fedora 36, RHEL-8.6, and RHEL9 and later

* Remove() - automatically covered by `semodule -r ...`

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the existing datastore implementation and compare its List, Get, Put, and Remove behavior with the semodule commands and libsemanage mentioned in the issue. Check the stated Fedora and RHEL versions; done means reaching agreement on the replacement design and its compatibility and behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
shell
Domain
security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.