Re: SELinuxDenyPtrace: Write, compile, run, but don't debug applications?

2012-04-09 Thread Eric Paris
On Mon, 2012-04-09 at 00:31 +0200, Kevin Kofler wrote: > It also > breaks crash reporters such as DrKonqi (for DrKonqi, we work around this by > disabling the flag in kde-runtime's %post script, but there are other > similar debuggers in upstream software, some not packaged in Fedora) I ask in

Re: selinux versus chcon

2011-09-19 Thread Eric Paris
On Mon, 2011-09-19 at 14:49 -0400, Fulko Hew wrote: > If so... why use chcon versus the semanage/restorecon technique? > or if my assesement is wrong... can someone point me to a better > explanation/tutorial? chcon is almost never the right way to go. It changes the file on the FS, but it is li

Re: Trusted Boot in Fedora

2011-06-22 Thread Eric Paris
On 06/22/2011 03:20 PM, seth vidal wrote: > On Wed, 2011-06-22 at 20:02 +0100, Matthew Garrett wrote: > Are we going to continue the double grub entries? while I realize that > tboot SHOULD allow non TXT hw to boot properly I also realize that any > differences will be pointed to as a point of con

Re: Trusted Boot in Fedora

2011-06-22 Thread Eric Paris
On 06/22/2011 03:01 PM, Jon Ciesla wrote: > >> Outside that, is there any other impact? Does tboot perform any >> verification of the kernels, and if so how is that configured? Is the >> expectation that an install configured with TXT will only boot trusted >> kernels, and if so what mechanism is

Re: Trusted Boot in Fedora

2011-06-22 Thread Eric Paris
On 06/22/2011 03:02 PM, Matthew Garrett wrote: > http://fedoraproject.org/wiki/Features/Trusted_Boot is a proposed > feature for F16. We've traditionally had a hard objection to the > functionality because it required either the distribution or downloading > of binary code that ran on the host C