Re: [PATCH v3] Do not use /etc/resolv.conf symbolic links on SELinux

On Thu, 2016-09-29 at 18:01 +0200, Guido Trentalancia wrote:
On Thu, 29/09/2016 at 17.52 +0200, Michael Biebl wrote:

Am 29.09.2016 um 17:33 schrieb Guido Trentalancia:

On Thu, 29/09/2016 at 17.29 +0200, Michael Biebl wrote:

Am 29.09.2016 um 17:11 schrieb Guido Trentalancia:

Run-time checks are wrong because they leave the filesystem
state that is not usable when SELinux goes back into

Compile-time checks have no side effects and in any case are
than the bug!

Debian enables selinux support during compile time but we do
selinux by default.

So the side-effect of this patch would be that suddenly NM
files instead of symlinks on Debian.

This is not a side-effect in my opinion, but an added benefit
there is no good reason for using a symbolic link.

So you want to get rid of the symbolic link altogether and selinux
only a diversion?

I am in favor of getting rid completely of the symbolic link
but this is outside of the scope of a simple patch created as a quick
fix of an existing bug.

I'll leave more extensive changes to the author... They are not
strictly required for running NetworkManager.


Hi Guido,

I don't see what is there to fix here.

If you dislike the setting, configure rc-manager=file (it is here to be
configured by the user).

If you build NM yourself, configure --with-config-dns-rc-manager-
default=file and have the setting to be the default (or fix your
selinux policy).

If your distro enables SELinux, it should either fix their selinux
policy or again build NM with --with-config-dns-rc-manager-

Using a symlink by default IMO makes a lot of sense, because this way
NM announces that it is in charge of managing resolv.conf. If you
manually change resolv.conf to be a symlink to anywhere else, NM will
automatically understand that it is not supposed to touch the symlink,
without requiring additional configuration from you.
This way, multiple management deamons can cooperate in who is in charge
of configuring resolv.conf.


Attachment: signature.asc
Description: This is a digitally signed message part

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]