From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Fri, 9 Sep 2011 12:28:57 -0400
Subject: [refpolicy] ANN: Reference Policy contrib repository
In-Reply-To: <1315585353.2170.6.camel@vortex>
References: <4E6A3225.2090502@tresys.com> <1315585353.2170.6.camel@vortex>
Message-ID: <4E6A3EC9.9000200@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 09/09/11 12:22, Guido Trentalancia wrote:
> On Fri, 2011-09-09 at 11:35 -0400, Christopher J. PeBenito wrote:
>> The challenge of Reference Policy has always been balancing the needs of having a well reviewed policy against responding to fairly rapid application development and new user needs in Linux.  If you are not familiar with the differences between the Reference Policy and Fedora policy, it is quite large.  Since Fedora is the largest SELinux-enabled distribution, its development version, rawhide, is on the front lines of seeing new features in apps.  Due to Dan and Miroslav's extensive work, the Fedora policy evolves rapidly.  However, this has proven to be too fast for me to constantly review all the changes and integrate them upstream, resulting in the huge difference between the two policies.
>>
>> To ameliorate this situation, additional contributors with commit access have been added for Reference Policy.  To be specific, a large amount of the policy has been moved into a contrib layer (a git submodule), where these contributors may commit.  The core policy modules will remain in the primary Reference Policy repository, for which I remain the maintainer.  Due to its nature, the contrib repository will be faster moving and less reviewed than the core Reference Policy repository.
>>
>> The core modules are critical modules on the system.  This includes all of the kernel layer, most of the system and roles layers, some admin modules, such as bootloader, su, and sudo, and userspace object managers.  It is possible to build a policy using only the core modules.  It is important to ensure these modules are well reviewed to ensure quality, so Reference Policy can be used as a base for both general-purpose systems (e.g. Linux distributions) and custom systems.  All remaining modules were moved to the contrib repository.  An important thing to note is that in the future, modules may move between core and contrib as necessary.
>>
>> For those that have a current checkout of the repository, you will need to do the following to get the new contrib submodule:
>>
>> $ git pull
>> $ git submodule init
>> $ git submodule update
> 
> Is such "contrib" submodule going to always remain optional ?

Its optional in the sense that you don't have to use any modules from it.  The core modules do have some optionals that reference contrib modules, so you need to have the submodule checked out so that those interfaces can resolve.  However, there should be no unconditional references from core modules to anything in contrib.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com