5c57870019
The new v3.0 SELInux userspace added support for optimizing the binary policy by pruning redundant rules from it. Enable it on Fedora by default, since it brings noticeable space savings and only negligibly increases policy build time. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
59 lines
2.4 KiB
Plaintext
59 lines
2.4 KiB
Plaintext
# Authors: Jason Tang <jtang@tresys.com>
|
|
#
|
|
# Copyright (C) 2004-2005 Tresys Technology, LLC
|
|
#
|
|
# This library is free software; you can redistribute it and/or
|
|
# modify it under the terms of the GNU Lesser General Public
|
|
# License as published by the Free Software Foundation; either
|
|
# version 2.1 of the License, or (at your option) any later version.
|
|
#
|
|
# This library is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
# Lesser General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Lesser General Public
|
|
# License along with this library; if not, write to the Free Software
|
|
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
#
|
|
# Specify how libsemanage will interact with a SELinux policy manager.
|
|
# The four options are:
|
|
#
|
|
# "source" - libsemanage manipulates a source SELinux policy
|
|
# "direct" - libsemanage will write directly to a module store.
|
|
# /foo/bar - Write by way of a policy management server, whose
|
|
# named socket is at /foo/bar. The path must begin
|
|
# with a '/'.
|
|
# foo.com:4242 - Establish a TCP connection to a remote policy
|
|
# management server at foo.com. If there is a colon
|
|
# then the remainder is interpreted as a port number;
|
|
# otherwise default to port 4242.
|
|
module-store = direct
|
|
|
|
# When generating the final linked and expanded policy, by default
|
|
# semanage will set the policy version to POLICYDB_VERSION_MAX, as
|
|
# given in <sepol/policydb.h>. Change this setting if a different
|
|
# version is necessary.
|
|
#policy-version = 19
|
|
|
|
# expand-check check neverallow rules when executing all semanage
|
|
# commands. There might be a penalty in execution time if this
|
|
# option is enabled.
|
|
expand-check=0
|
|
|
|
# usepasswd check tells semanage to scan all pass word records for home directories
|
|
# and setup the labeling correctly. If this is turned off, SELinux will label /home
|
|
# correctly only. You will need to use semanage fcontext command.
|
|
# For example, if you had home dirs in /althome directory you would have to execute
|
|
# semanage fcontext -a -e /home /althome
|
|
usepasswd=False
|
|
bzip-small=true
|
|
bzip-blocksize=5
|
|
ignoredirs=/root
|
|
optimize-policy=true
|
|
|
|
[sefcontext_compile]
|
|
path = /usr/sbin/sefcontext_compile
|
|
args = -r $@
|
|
[end]
|