Features/SELinuxBooleansRename

From FedoraProject

< Features(Difference between revisions)
Jump to: navigation, search
(Rename all booleans that currently begin with the word allow_)
 
(Current status)
 
(11 intermediate revisions by 2 users not shown)
Line 1: Line 1:
{{admon/important | Comments and Explanations | The page source contains comments providing guidance to fill out each section.  They are invisible when viewing this page.  To read it, choose the "edit" link.<br/> '''Copy the source to a ''new page'' before making changes!  DO NOT EDIT THIS TEMPLATE FOR YOUR FEATURE.'''}}
 
 
{{admon/important | Set a Page Watch| Make sure you click ''watch'' on your new page so that you are notified of changes to it by others, including the Feature Wrangler}}
 
 
{{admon/note | All sections of this template are required for review by FESCo.  If any sections are empty it will not be reviewed }}
 
 
 
<!-- All fields on this form are required to be accepted by FESCo.
 
We also request that you maintain the same order of sections so that all of the feature pages are uniform.  -->
 
 
<!-- The actual name of your feature page should look something like: Features/Your_Feature_Name.  This keeps all features in the same namespace -->
 
 
 
= Feature Name <!-- The name of your feature --> =
 
= Feature Name <!-- The name of your feature --> =
 
+
SELinux Rename Booleans Feature
 
== Summary ==
 
== Summary ==
 
<!-- A sentence or two summarizing what this feature is and what it will do.  This information is used for the overall feature summary page for each release. -->
 
<!-- A sentence or two summarizing what this feature is and what it will do.  This information is used for the overall feature summary page for each release. -->
 +
Rename all booleans that currently begin with allow_ to something that is more domain specific.
  
 
== Owner ==
 
== Owner ==
 
<!--This should link to your home wiki page so we know who you are-->
 
<!--This should link to your home wiki page so we know who you are-->
* Name: [[User:FASAcountName| Your Name]]
+
* Name: [[User:dwalsh| Daniel Walsh]]
  
 
<!-- Include you email address that you can be reached should people want to contact you about helping with your feature, status is requested, or  technical issues need to be resolved-->
 
<!-- Include you email address that you can be reached should people want to contact you about helping with your feature, status is requested, or  technical issues need to be resolved-->
* Email: <your email address so we can contact you, invite you to meetings, etc.>
+
* Email: <dwalsh@redhat.com>
  
 
== Current status ==
 
== Current status ==
* Targeted release: [[Releases/<number> | Fedora <number> ]]  
+
* Targeted release: [Fedora 18]  
* Last updated: (DATE)
+
* Last updated: Aug 13 2012
* Percentage of completion: XX%
+
* Percentage of completion: 100%
  
 
<!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. -->
 
<!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. -->
Line 32: Line 21:
 
== Detailed Description ==
 
== Detailed Description ==
 
<!-- Expand on the summary, if appropriate.  A couple sentences suffices to explain the goal, but the more details you can provide the better. -->
 
<!-- Expand on the summary, if appropriate.  A couple sentences suffices to explain the goal, but the more details you can provide the better. -->
 +
We want to rename the booleans in policy to better names.  We need to modify libselinux to allow us to have a translation table to translate old names to new names. This will allow old boolean names to continue to work.  Stale documentation and google searches for boolean names, will turn up old boolean names, so we need to be backward compatible.
  
 
== Benefit to Fedora ==
 
== Benefit to Fedora ==
 
<!-- What is the benefit to the platform?  If this is a major capability update, what has changed?  If this is a new feature, what capabilities does it bring? Why will Fedora become a better distribution or project because of this feature?-->
 
<!-- What is the benefit to the platform?  If this is a major capability update, what has changed?  If this is a new feature, what capabilities does it bring? Why will Fedora become a better distribution or project because of this feature?-->
 +
Over the years as SELinux policy has evolved boolean names have been created somewhat randomly, the worst offender of these has been the allow_NAME booleans.  We have slowly standardized on a format of DOMAIN_action name, but we still have lots of old badly named booleans.  This fix will rename the booleans to something that makes better sense, but will continue to support the old booleans so scripts, documentation and web searches that return the old names will continue to work.  Also if you are using an older system and wanted to set allow_polyinstantion on all platforms you will be able to set it on the new system, even thought the boolean name has been renamed to polyinstantion_enabled.
 +
  
 
== Scope ==
 
== Scope ==
 
<!-- What work do the developers have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
 
<!-- What work do the developers have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
 
+
Need to change libselinux to support boolean translations.
 +
Need to modify selinux-policy to actually change the names.
 +
Need to modify man pages to reflect the changes.
 +
Might need to look at Fedora Documentation to make sure it reflects the change.
 
== How To Test ==
 
== How To Test ==
 
<!-- This does not need to be a full-fledged document.  Describe the dimensions of tests that this feature is expected to pass when it is done.  If it needs to be tested with different hardware or software configurations, indicate them.  The more specific you can be, the better the community testing can be.  
 
<!-- This does not need to be a full-fledged document.  Describe the dimensions of tests that this feature is expected to pass when it is done.  If it needs to be tested with different hardware or software configurations, indicate them.  The more specific you can be, the better the community testing can be.  
Line 53: Line 48:
 
3. What are the expected results of those actions?
 
3. What are the expected results of those actions?
 
-->
 
-->
 +
Check boolean names using semanage boolean -l, and make sure none begin with allow_.
 +
Look at Fedora 17 and test some of the boolean names there that begin with allow_ and attempt to turn the boolean on using both semanage and setsebool.
 +
 +
setsebool -P allow_httpd_anon_write 1
 +
 +
Attempt to retrieve the boolean setting using getsebool
 +
 +
getsebool allow_ypbind
 +
  
 
== User Experience ==
 
== User Experience ==
 
<!-- If this feature is noticeable by its target audience, how will their experiences change as a result?  Describe what they will see or notice. -->
 
<!-- If this feature is noticeable by its target audience, how will their experiences change as a result?  Describe what they will see or notice. -->
 +
 +
They may notice that some of the boolean names have changed, if they use the old name it will continue to work, but if they look at all booleans they might not see some of the names they are used to.  Overall I think this will positively effect users.
 +
 +
One big benefit will be for command completion.
 +
 +
setsebool -P http<TAB>
 +
 +
Should give a much better list of all booleans associated with the http domain.
  
 
== Dependencies ==
 
== Dependencies ==
 
<!-- What other packages (RPMs) depend on this package?  Are there changes outside the developers' control on which completion of this feature depends?  In other words, completion of another feature owned by someone else and might cause you to not be able to finish on time or that you would need to coordinate?  Other upstream projects like the kernel (if this is not a kernel feature)? -->
 
<!-- What other packages (RPMs) depend on this package?  Are there changes outside the developers' control on which completion of this feature depends?  In other words, completion of another feature owned by someone else and might cause you to not be able to finish on time or that you would need to coordinate?  Other upstream projects like the kernel (if this is not a kernel feature)? -->
  
 +
None
 
== Contingency Plan ==
 
== Contingency Plan ==
 
<!-- If you cannot complete your feature by the final development freeze, what is the backup plan?  This might be as simple as "None necessary, revert to previous release behaviour."  Or it might not.  If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy.  -->
 
<!-- If you cannot complete your feature by the final development freeze, what is the backup plan?  This might be as simple as "None necessary, revert to previous release behaviour."  Or it might not.  If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy.  -->
  
 +
No Problem.  We can continue to use the old names.
 
== Documentation ==
 
== Documentation ==
 
<!-- Is there upstream documentation on this feature, or notes you have written yourself?  Link to that material here so other interested developers can get involved. -->
 
<!-- Is there upstream documentation on this feature, or notes you have written yourself?  Link to that material here so other interested developers can get involved. -->
Line 70: Line 84:
 
<!-- The Fedora Release Notes inform end-users about what is new in the release.  Examples of past release notes are here: http://docs.fedoraproject.org/release-notes/ -->
 
<!-- The Fedora Release Notes inform end-users about what is new in the release.  Examples of past release notes are here: http://docs.fedoraproject.org/release-notes/ -->
 
<!-- The release notes also help users know how to deal with platform changes such as ABIs/APIs, configuration or data file formats, or upgrade concerns.  If there are any such changes involved in this feature, indicate them here.  You can also link to upstream documentation if it satisfies this need.  This information forms the basis of the release notes edited by the documentation team and shipped with the release. -->
 
<!-- The release notes also help users know how to deal with platform changes such as ABIs/APIs, configuration or data file formats, or upgrade concerns.  If there are any such changes involved in this feature, indicate them here.  You can also link to upstream documentation if it satisfies this need.  This information forms the basis of the release notes edited by the documentation team and shipped with the release. -->
*
+
* Several SELinux booleans names have been changed.  Mainly booleans beginning with allow_ will now begin with a domain specific name, for example allow_httpd_anon_write has been changed to httpd_anon_write.  If you set or get the old boolean name, it will continue to work, but the old boolean name will no longer show up in lists of booleans.
  
 
== Comments and Discussion ==
 
== Comments and Discussion ==
* See [[Talk:Features/Your_Feature_Name]]  <!-- This adds a link to the "discussion" tab associated with your page.  This provides the ability to have ongoing comments or conversation without bogging down the main feature page -->
+
* See [[Talk:Features/SELinuxBooleansRename]]  <!-- This adds a link to the "discussion" tab associated with your page.  This provides the ability to have ongoing comments or conversation without bogging down the main feature page -->
 
+
  
[[Category:FeaturePageIncomplete]]
+
[[Category:FeatureAcceptedF18]]
 
<!-- When your feature page is completed and ready for review -->
 
<!-- When your feature page is completed and ready for review -->
 
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler -->
 
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler -->
 
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete-->
 
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete-->
 
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process -->
 
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process -->

Latest revision as of 13:23, 27 September 2012

Contents

[edit] Feature Name

SELinux Rename Booleans Feature

[edit] Summary

Rename all booleans that currently begin with allow_ to something that is more domain specific.

[edit] Owner

  • Email: <dwalsh@redhat.com>

[edit] Current status

  • Targeted release: [Fedora 18]
  • Last updated: Aug 13 2012
  • Percentage of completion: 100%


[edit] Detailed Description

We want to rename the booleans in policy to better names. We need to modify libselinux to allow us to have a translation table to translate old names to new names. This will allow old boolean names to continue to work. Stale documentation and google searches for boolean names, will turn up old boolean names, so we need to be backward compatible.

[edit] Benefit to Fedora

Over the years as SELinux policy has evolved boolean names have been created somewhat randomly, the worst offender of these has been the allow_NAME booleans. We have slowly standardized on a format of DOMAIN_action name, but we still have lots of old badly named booleans. This fix will rename the booleans to something that makes better sense, but will continue to support the old booleans so scripts, documentation and web searches that return the old names will continue to work. Also if you are using an older system and wanted to set allow_polyinstantion on all platforms you will be able to set it on the new system, even thought the boolean name has been renamed to polyinstantion_enabled.


[edit] Scope

Need to change libselinux to support boolean translations. Need to modify selinux-policy to actually change the names. Need to modify man pages to reflect the changes. Might need to look at Fedora Documentation to make sure it reflects the change.

[edit] How To Test

Check boolean names using semanage boolean -l, and make sure none begin with allow_. Look at Fedora 17 and test some of the boolean names there that begin with allow_ and attempt to turn the boolean on using both semanage and setsebool.

setsebool -P allow_httpd_anon_write 1

Attempt to retrieve the boolean setting using getsebool

getsebool allow_ypbind


[edit] User Experience

They may notice that some of the boolean names have changed, if they use the old name it will continue to work, but if they look at all booleans they might not see some of the names they are used to. Overall I think this will positively effect users.

One big benefit will be for command completion.

setsebool -P http<TAB>

Should give a much better list of all booleans associated with the http domain.

[edit] Dependencies

None

[edit] Contingency Plan

No Problem. We can continue to use the old names.

[edit] Documentation

[edit] Release Notes

  • Several SELinux booleans names have been changed. Mainly booleans beginning with allow_ will now begin with a domain specific name, for example allow_httpd_anon_write has been changed to httpd_anon_write. If you set or get the old boolean name, it will continue to work, but the old boolean name will no longer show up in lists of booleans.

[edit] Comments and Discussion