Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: Are we on the wrong track?
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
References: <3243717.6S2XvbbdUs@liv>
From:   Topi Miettinen <toiwoton@gmail.com>
Message-ID: <df15dc67-343b-0060-27c3-12c277349e33@gmail.com>
Date:   Fri, 12 Jun 2020 10:05:07 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.9.0
MIME-Version: 1.0
In-Reply-To: <3243717.6S2XvbbdUs@liv>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 12.6.2020 3.03, Russell Coker wrote:
> The reference policy is getting an increasing number of domains and types with
> an O(N^2) level of complexity for writing policy and an O(N^2) size of the
> binary policy.  In 2012 the binary policy on my machines was 560k, now it's
> over 2M.

The policy can be shrunk by disabling unused modules, mine is 760k 
because only 166 modules are enabled out of 506. Some of the modules are 
for more or less obsolete software (e.g. hal, rlogin, uucp), or they may 
target proprietary software, which may be of unknown relevance today. 
Perhaps they should be disabled by default, removed from refpolicy or 
moved aside to directory "extra" or "Attic"?

The package installer could also propose groups like "all", "most", 
"recommended", "distro-only" (disable all 3rd party stuff), "minimal" to 
enable/disable modules.

-Topi