DSP - custom SELinux policy modules done right
summary
Decentralized SELinux Policy (DSP) packages custom SELinux modules with each component so policies ship with releases, avoiding the common lag where policy updates arrive after new features; it provides a step-by-step packaging guide, a sepolicy generate helper to bootstrap modules, a guideline for API stability, and a test suite that flags overly- permissive rules and packaging mistakes. Policies can be delivered as a subpackage or standalone with conditional requires to avoid contaminating minimal images; contributors verify compatibility across Fedora/RHEL targets, file PRs for review, and run tests in permissive mode to collect AVCs.
AI-written summary · about
chapters (7)
related talks
45mSELinux All the Way Down: Namespaces for SELinux
14mWhat Have I Modified in SELinux: a new addition to your SELinux toolbox
31mOverview and Recent Developments: SELinux
11mSubsystem Update: State of SELinux, 2019
38mCustom SELinux container policies in OpenShift
19mSELinux Update
09mSub-system Update: State of SELinux
46m20 years of NSA Security Enhanced Linux, a Retrospective