From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Mon, 27 Feb 2012 10:06:49 -0500
Subject: [refpolicy] Build of 20120215 fails with unknown role system_r
In-Reply-To: <20120226122452.GB22698@siphos.be>
References: <20120225100547.GA28560@siphos.be> <4F49FAD9.80102@windriver.com>
	<20120226122452.GB22698@siphos.be>
Message-ID: <4F4B9C09.4080007@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 02/26/12 07:24, Sven Vermeulen wrote:
> On Sun, Feb 26, 2012 at 05:26:49PM +0800, Harry Ciao wrote:
> [...]
>> system_r is actually defined in kernel.te. By default, there are only a 
>> limited number of modules that would be built into base.pp and its 
>> declaration happens before its first reference :
>>
>> $ grep "= base" policy/modules.conf
>> corecommands = base
>> corenetwork = base
>> devices = base
>> domain = base
>> files = base
>> filesystem = base
>> kernel = base
>> mcs = base
>> mls = base
>> selinux = base
>> terminal = base
>> ubac = base
> 
> Well, I'm currently looking at using the default set for our base policy
> (which seems to work well) but is the base set something we need to fix (as
> in, users of refpolicy shouldn't update the list of modules belonging to
> base) or is it something configurable?

Contents of the base module is supposed to be configurable, as long as you have all of the modules that are required to be in the base module, and all dependencies of the modules in base are met.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com