On Fri, Sep 18, 2009 at 10:26 AM, Jay Greguske <jgregusk(a)redhat.com&gt; wrote: > Daniel J Walsh wrote: > >> On 09/11/2009 04:47 PM, Jay Greguske wrote: >> >>> While using livecd-creator and poking around the code, I found a check >>> that I don't understand the reason for. livecd-creator will bail out if >>> the host has SELinux disabled and the kickstart file requests it be >>> enabled. Why is that? I would think that if SELinux was disabled but you >>> still had the policy available, that would be all you need to build a >>> properly labeled image. >>> [snip] >>> Perhaps the failure condition is no longer necessary? >>> >>> >> Yes I think that is no longer necessary. And it should definitely be supported. >> >> > Attached is a cleaner patch that removes the check and some other > unnecessary code (thanks Dan). With this users should be able to build > livecd images that have SELinux enabled on an SELinux-disabled host. > I've tested this on an F10 system with an F10 and a RHEL 5 kernel. Both > kernels I was able to build images with the SELinux enabled and disabled > on the host (but always enabled in the kickstart file). > There have been some problems more recently with the booleans stuff if SELinux isn't enabled. Does that all end up working correctly still? I'm not fundamentally opposed to the patch; it's just historically been something which didn't work. - Jeremy

On Fri, Sep 25, 2009 at 8:59 AM, Jay Greguske <jgregusk(a)redhat.com&gt; wrote: > Jeremy Katz wrote: > >> There have been some problems more recently with the booleans stuff if >> SELinux isn't enabled. Does that all end up working correctly still? >> >> > I'll look into it. Are there any you have in mind specifically? > Dan might remember better than I -- I vaguely remember that a lot of the home directory bits and also some of the xguest stuff requires working booleans - Jeremy

Jay Greguske wrote: > Jeremy Katz wrote: > >> On Fri, Sep 25, 2009 at 8:59 AM, Jay Greguske <jgregusk(a)redhat.com&gt; wrote: >> >> >>> Jeremy Katz wrote: >>> >>> >>>> There have been some problems more recently with the booleans stuff if >>>> SELinux isn't enabled.  Does that all end up working correctly still? >>>> >>>> >>>> >>> I'll look into it. Are there any you have in mind specifically? >>> >>> >> Dan might remember better than I -- I vaguely remember that a lot of >> the home directory bits and also some of the xguest stuff requires >> working booleans >> >> - Jeremy >> >> > I installed xguest to a running livecd (desktop ks file) and played with > two booleans related to it: browser_write_xguest_data, and > xguest_connect_network. With the former turned off the Guest account > could not download files from random internet sites, and with the latter > it couldn't connect at all, so I'd say they were functioning as > expected. I'm pretty confident SELinux booleans are working correctly > with these changes. If you have other tests to suggest I'd be happy to > try them out. > > Thanks, > - Jay > > -- > Fedora-livecd-list mailing list > Fedora-livecd-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-livecd-list > > Is there anything more I can do to scoot these changes along? I don't want them to fall off radar...