Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <8776cbb2687a09ed5b4e5b3cf0c50ade6c018fa6.camel@btinternet.com>
Subject: Re: [RFC PATCH 1/1] selinux-notebook: Add new section for Embedded
 Systems
From:   Richard Haines <richard_c_haines@btinternet.com>
To:     Dominick Grift <dominick.grift@defensec.nl>
Cc:     selinux@vger.kernel.org, selinux-refpolicy@vger.kernel.org
Date:   Wed, 20 Jan 2021 11:55:02 +0000
In-Reply-To: <ypjleeihm5e0.fsf@defensec.nl>
References: <20210119105747.9680-1-richard_c_haines@btinternet.com>
         <20210119105747.9680-2-richard_c_haines@btinternet.com>
         <ypjleeihm5e0.fsf@defensec.nl>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.38.3 (3.38.3-1.fc33) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Tue, 2021-01-19 at 14:18 +0100, Dominick Grift wrote:
> Richard Haines <richard_c_haines@btinternet.com> writes:
> 
> > Add a new section and supporting examples for embedded systems.
> 
> Nice initiative, thanks. Looks pretty solid for a first iteration.
> 
> I wrote a document for OpenWrt here [1]. Basically the instructions
> needed
> to assemble OpenWrt from modules applicable to a particular system,
> but also how
> to build on top of it, or now to just fork it so that you can use it
> as
> a base for your own policy.
> 
> [1] 
> https://github.com/doverride/openwrt-selinux-policy/blob/master/README.md
> 
> I am currently pretty happy with the results so far (its a work in
> progress, and there are known loose ends)
> 
> One of the differences compared with android is that SELinux is not
> tightly integrated in OpenWrt, and so most of the tough aspects are
> addressed in policy
> rather than adding selinux-awareness all over. SELinux in OpenWrt is
> therefore
> fairly self-contained and considering the challenges fairly robust.
> 

Thanks, I've worked these comments into the next version.