PR#131: Drop obsolete modules from config - rpms/selinux-policy

rpms / selinux-policy

#131 Drop obsolete modules from config

Opened 3 years ago by omos. Modified 2 years ago

rpms/ omos/selinux-policy drop-obsolete-modules into rawhide

Drop obsolete modules from config

Ondrej Mosnacek • 3 years ago

fbf116c

modules-mls-contrib.conf

file modified

-7

		`@@ -928,13 +928,6 @@`
		`pingd = module`

		`# Layer: services`
		`- # Module: piranha`
		`- #`
		`- # piranha - various tools to administer and configure the Linux Virtual Server`
		`- #`
		`- piranha = module`
		`-`
		`- # Layer: services`
		`# Module: plymouthd`
		`#`
		`# Plymouth`

modules-targeted-contrib.conf

file modified

-106

		`@@ -40,13 +40,6 @@`
		`#`
		`aide = module`

		`- # Layer: services`
		`- # Module: ajaxterm`
		`- #`
		`- # Web Based Terminal`
		`- #`
		`- ajaxterm = module`
		`-`
		`# Layer: admin`
		`# Module: alsa`
		`#`
		`@@ -117,13 +110,6 @@`
		`#`
		`asterisk = module`

		`- # Layer: contrib`
		`- # Module: authconfig`
		`- #`
		`- # Authorization configuration tool`
		`- #`
		`- authconfig = module`
		`-`
		`# Layer: services`
		`# Module: automount`
		`#`
		`@@ -209,13 +195,6 @@`
		`bugzilla = module`

		`# Layer: services`
		`- # Module: bumblebee`
		`- #`
		`- # Support NVIDIA Optimus technology under Linux`
		`- #`
		`- bumblebee = module`
		`-`
		`- # Layer: services`
		`# Module: cachefilesd`
		`#`
		`# CacheFiles userspace management daemon`
		`@@ -539,13 +518,6 @@`
		`dictd = module`

		`# Layer: services`
		`- # Module: dirsrv-admin`
		`- #`
		`- # An 309 directory admin server`
		`- #`
		`- dirsrv-admin = module`
		`-`
		`- # Layer: services`
		`# Module: dirsrv`
		`#`
		`# An 309 directory server`
		`@@ -1050,13 +1022,6 @@`
		`milter = module`

		`# Layer: services`
		`- # Module: mip6d`
		`- #`
		`- # UMIP Mobile IPv6 and NEMO Basic Support protocol implementation`
		`- #`
		`- mip6d = module`
		`-`
		`- # Layer: services`
		`# Module: mock`
		`#`
		`# Policy for mock rpm builder`
		`@@ -1367,13 +1332,6 @@`
		`#`
		`pingd = module`

		`- # Layer: services`
		`- # Module: piranha`
		`- #`
		`- # piranha - various tools to administer and configure the Linux Virtual Server`
		`- #`
		`- piranha = module`
		`-`
		`# Layer: contrib`
		`# Module: pkcs`
		`#`
		`@@ -1787,13 +1745,6 @@`
		`#`
		`setroubleshoot = module`

		`- # Layer: services`
		`- # Module: sge`
		`- #`
		`- # policy for grindengine MPI jobs`
		`- #`
		`- sge = module`
		`-`
		`# Layer: admin`
		`# Module: shorewall`
		`#`
		`@@ -2262,13 +2213,6 @@`
		`#`
		`pki = module`

		`- # Layer: services`
		`- # Module: smsd`
		`- #`
		`- # policy for smsd`
		`- #`
		`- smsd = module`
		`-`
		`# Layer: contrib`
		`# Module: pesign`
		`#`
		`@@ -2389,13 +2333,6 @@`
		`ipa = module`

		`# Layer: contrib`
		`- # Module: mirrormanager`
		`- #`
		`- # mirrormanager policy`
		`- #`
		`- mirrormanager = module`
		`-`
		`- # Layer: contrib`
		`# Module: snapper`
		`#`
		`# snapper policy`
		`@@ -2454,21 +2391,6 @@`
		`iotop = module`

		`# Layer: contrib`
		`- # Module: kmscon`
		`- #`
		`- # kmscon policy`
		`- #`
		`-`
		`- kmscon = module`
		`-`
		`- # Layer: contrib`
		`- # Module: naemon`
		`- #`
		`- # naemon policy`
		`- #`
		`- naemon = module`
		`-`
		`- # Layer: contrib`
		`# Module: brltty`
		`#`
		`# brltty policy`
		`@@ -2504,13 +2426,6 @@`
		`linuxptp = module`

		`# Layer: contrib`
		`- # Module: rolekit`
		`- #`
		`- # rolekit policy`
		`- #`
		`- rolekit = module`
		`-`
		`- # Layer: contrib`
		`# Module: targetd`
		`#`
		`# targetd policy`
		`@@ -2532,13 +2447,6 @@`
		`blkmapd = module`

		`# Layer: contrib`
		`- # Module: pkcs11proxyd`
		`- #`
		`- # pkcs11proxyd policy`
		`- #`
		`- pkcs11proxyd = module`
		`-`
		`- # Layer: contrib`
		`# Module: ipmievd`
		`#`
		`# IPMI event daemon for sending events to syslog`
		`@@ -2567,13 +2475,6 @@`
		`lttng-tools = module`

		`# Layer: contrib`
		`- # Module: rkt`
		`- #`
		`- # CLI for running app containers`
		`- #`
		`- rkt = module`
		`-`
		`- # Layer: contrib`
		`# Module: opendnssec`
		`#`
		`# opendnssec`
		`@@ -2644,13 +2545,6 @@`
		`kpatch = module`

		`# Layer: contrib`
		`- # Module: timedatex`
		`- #`
		`- # timedatex`
		`- #`
		`- timedatex = module`
		`-`
		`- # Layer: contrib`
		`# Module: rrdcached`
		`#`
		`# rrdcached`

modules-targeted.conf

file modified

-28

		`@@ -25,13 +25,6 @@`
		`#`
		`acct = module`

		`- # Layer: services`
		`- # Module: ajaxterm`
		`- #`
		`- # Web Based Terminal`
		`- #`
		`- ajaxterm = module`
		`-`
		`# Layer: admin`
		`# Module: alsa`
		`#`
		`@@ -237,13 +230,6 @@`
		`dirsrv = module`

		`# Layer: services`
		`- # Module: dirsrv-admin`
		`- #`
		`- # An 309 directory admin server`
		`- #`
		`- dirsrv-admin = module`
		`-`
		`- # Layer: services`
		`# Module: dnsmasq`
		`#`
		`# A lightweight DHCP and caching DNS server.`
		`@@ -1278,13 +1264,6 @@`
		`pegasus = module`

		`# Layer: services`
		`- # Module: piranha`
		`- #`
		`- # piranha - various tools to administer and configure the Linux Virtual Server`
		`- #`
		`- piranha = module`
		`-`
		`- # Layer: services`
		`# Module: postgresql`
		`#`
		`# PostgreSQL relational database`
		`@@ -2480,13 +2459,6 @@`
		`#`
		`obex = module`

		`- # Layer: services`
		`- # Module: sge`
		`- #`
		`- # policy for grindengine MPI jobs`
		`- #`
		`- sge = module`
		`-`
		`# Layer: apps`
		`# Module: jockey`
		`#`

omos commented 3 years ago

Remove modules for packages retired from Fedora that are not present in
refpolicy sources. There is no need to ship or build them as the
associated software is not supported on Fedora nor RHEL (I checked).

zuul commented 3 years ago

Build failed.

rpm-scratch-build : POST_FAILURE in 2m 05s
rpm-linter : SKIPPED
rpm-rpminspect : SKIPPED (non-voting)
check-for-tests : SKIPPED
rpm-install-test : SKIPPED
rpm-test : SKIPPED

rebased onto fbf116c

3 years ago

zuul commented 3 years ago

Build failed.

rpm-scratch-build : SUCCESS in 9m 30s
rpm-linter : FAILURE in 4m 42s
rpm-rpminspect : SUCCESS in 9m 12s (non-voting)
check-for-tests : SUCCESS in 6s
rpm-install-test : SKIPPED
rpm-test : FAILURE in 57m 12s

zpytela commented 3 years ago

I don't think timedatex module should be a subject of removal atm:
https://bugzilla.redhat.com/show_bug.cgi?id=1883906

@omos, if we stop shipping a module, shouldn't we also accompany it with dropping all its references from policy?

omos commented 3 years ago

I don't think timedatex module should be a subject of removal atm:
https://bugzilla.redhat.com/show_bug.cgi?id=1883906

Okay, I see I have put a false statement in the description... Some of the more recently removed software is still present on certain versions of RHEL, so I need to rephrase that.

Still, I don't think that it makes much of a difference. In RHEL, the policy will be still present and can be maintained downstream-only (same as timedatex and other components are right now). There is no point in going through the upstream process for policy that can't be utilized nor tested on Fedora.

@omos, if we stop shipping a module, shouldn't we also accompany it with dropping all its references from policy?

In this case (modules that are not in refpolicy), it is definitely something I plan to do. I have a patch ready, but removing from dist-git config is the first step. (For modules that are still present in refpolicy I haven't made my mind yet - keeping them might make eventual future realignment with refpolicy easier... I know, that would be essentially a miracle at this point, but I'm still keeping a drop of hope :)

mmalik commented 3 years ago

[citest]

vmojzis commented 2 years ago

Just to be safe, I'd prefer that we keep the .if files, but with each interface enclosed in an ifndef statement (that way the interfaces are available if needed and there are no warnings of multiple definitions of each interface in case someone decides to ship some of the modules via DSP). It wouldn't be the first time we accidentally removed an interface that was in use by someone.
BTW, the following needs to be merged in order for the .if files to be shipped after being removed from the .conf files:
https://github.com/fedora-selinux/selinux-policy/pull/856