Postings by Daniel J Walsh

I wrote a blog on why we moved Fedora 31 to cgroup V2

<a href="" title=""></a>

If you like it, please put it out on social media.

How do you Remove packages from the distro?

 How do I go about removing packages from Fedora Distro.  I want to drop
oci-systemd-hook and oci-register-machine?  I would love to remove them
from f31 but it might be too late.


I have opened a Change Request to change the defaults for Fedora 31 to
Cgroups V2.  I am looking for what packages will be affected by this
change.   Basically any package that adjusts Cgroups via the CgroupFS,
my understanding is working the the systemd APIs, you should be fine.

Packages That I know will be affected:

Container Tools

* Runc, Podman, Buildah, Kubernetes, Docker, Moby-engine

Virtualization tools

* Libvirt


* jvm


* Anaconda

Anyone know of other packages? support for Fedora?

Has anyone looked at supporting in Fedora.

This question was asked here.

<a href="" title=""></a>

In the OpenShift Origin/CRI-O/Kubernetes effort we have a dilemma.

Users of OpenSHift Origin require CRI-O 1.10 right now.  But Kubernetes
users want to try out the latest packages for kubernetes 1.11 which
would require CRI-O 1.11.  Origin might not be ready to move to
Kubernetes 1.11 for a while.

Bottom line we want to be able to ship CRI-0 1.10.* and CRI-O 1.11.*
releases in the same Fedora 28.

I believe this is what Modularity was designed to fix.

Can I do this with Modularity?  If I can how do I use fedpkg to make
this happen?


I would like to propose that we turn on XFS Reflink in Fedora 29 by default

We are adding some features to container projects for User Namespace
support that can take advantage of XFS Reflink.  I have talked to some
of the XFS Reflink kernel engineers in Red Hat and they have informed me
that they believe it is ready to be turned on by default.

I am not sure who in Red Hat I should talk to about this?

Wrote a new blog for OpenSource.Com on evolution of containers.

<a href="" title=""></a>

If you like it, please social Media this message out.

Changing default "docker" storage to to Overlay2 in Fedora 26

Upstream docker is moving to overlay2 by default for its storage. We
plan on following suit. Their are some performance advantages of
overlay2 over devicemapper in memory sharing, which we would like to
take advantage of.

Modifying container storage for Fedora 26.

We would like to change the docker container storage to default to
Overlayfs2 in Fedora 26. But we have a problem on Atomic Host and
Fedora Server distributions.

Currently docker-storage-setup defaults to devicemapper and is hard
coded to setup a thinpool of 40% of remaining disk. Otherwise it sets
up loopback devices on the root file system. Devicemapper is nice
since it works with thinpools and can automatically expand the storage
if the disk space is getting used up.

Moving to Overlay, we can more easily use the root file system directly,
which would be fine for Fedora Workstation.

New Article on Future Docker Security.

<a href="" title=""></a>

I want to make Ryan Hallisey a co-maintainer of policycoreutils.

He is not currently in the packager list. But he does not have a
package that needs to be added to Fedora. He is just making changes to

What is the procedure to get him on the packager list for this package.


Time to start blogging on all of the new Security features in Fedora 21

If you have one, please send it to me with some explanation of what it
is and why it is important.

Anyone know how to get rsyslog to not use journald but to listen on /dev/log again.

We need this for running rsyslog within a docker container where
systemd/journald might not be running.

<a href="" title=""></a>

Docker problems with centos 6 image based on libselinux.

People are reporting problems in Fedora about using centos rhel6 images.

<a href="" title=""></a>

The problem is the libselinux in the centos image is reporting that
SELinux is enabled to processes running within the container. Tools
like useradd and groupadd to attempt to write to /proc/self/attr/* files
in order to setup proper labeling for SELinux. Since /proc is now
mounted read/only within the docker containers, the writes are denied
and useradd/groupadd fail.

I wrote the attached patch for RHEL6 libselinux to get RHEL6 images to
work properly.

We want to stop systemd from being added to docker images, because of rpm requiring systemctl.

The problem is lots of services require systemd because they ship a
unit file and want systemctl reload to happen. Systemd then triggers a
require for udev and kmod, which docker containers do not need.

rpm -q --whatrequires systemd| wc -l

On rawhide I see 151 packages on my system which require systemd.

We have a couple of options we could add a package called fakesystemd
which provides a /usr/bin/systemctl that does nothing and does a
provides systemd in the specfile.

I want to turn on a part of the kernel to make SELinux checking more stringent.

I wrote a systemd unit file to enable it, and to allow a user to disable the
feature if he wants.

# cat /usr/lib/systemd/system/selinux-checkreqprot.service
Description=SELinux check actual protection flags applied by kernel, rather
than checking what application requested.

ExecStart=/bin/sh -c '/bin/echo $CHECKREQPROT > /sys/fs/selinux/checkreqprot'

I would like to enable this service on the post install of a initial install
of libselinux.

There used to be a way to minimize the address section on Thunderbird

This seems to have gone a way from Fedora 20/21 thunderbird.

rpm -q thunderbird

Is this intended? Is this a bug? Is there a setting where I can turn this
back on?

Wasting this screen real estate on a small screen is painful.

I am thinking of adding compression to libselinux

Basically looking at compressing the policy file to shrink SELinux footprint
in the minimal install/cloud image.

Currently the policy modules (pp files) are shipped with bzip compression but
the actually policy file.

But the /etc/selinux/targeted/policy/policy.29 is not compressed. systemd and
load_policy use libselinux to read in the policy file and load it into the
kernel, so since systemd currently uses libxz, I figured this would be the
best solution to add libxz support to libselinux.

ls -l /etc/selinux/targeted/policy/policy.29*
- -rw-r--r--.

Anyone bought the CLover sunbook and made Fedora run on it.

I have dreamed for years of buying a laptop that I can actually use outside,
but I don't want to run Windows on it.

It is a little steep at 700 + 75 for ssd.

<a href="" title=""></a>

Does -devel package name only indicate "C" development packages?

<a href="" title=""></a>

I have a request to change the name of selinux-policy-devel to
selinux-policy-devel-support, since

"everywhere else in the distro -devel means just header files in c and not any
other development tools and we have several scripts that assume that's the case."

selinux-policy-devel contains interface files and tools required to build

Each Fedora release I do series of blog on New Security Feature coming in the next Fedora.

I need ideas for what to write about in Fedora 19. Could people send some to me.

If you google "security features" you will see
a lot of the past blogs.

Things I have covered in the past in addition to SELinux advances, systemd
improvements, journald, kerberos moving the cache, FreeIPA integration with
ActiveDirectory, audit improvement, libvirt/containers ...


Orphaning libmatchbox

Since sandbox has moved over to use openbox. (Someday I dream of it using

I no longer need libmatchbox, and since I believe sandbox was the last app to
require it, we could probably retire the package, unless anyone else needs it.

Is there a reason we do not turn on the file system hardlink/symlink protection in Rawhide?

sysctl -a | grep protected
fs.protected_hardlinks = 0
fs.protected_symlinks = 0

Customizing Firefox Search.

Any know of a way to build a customized search into firefox. Basically I want
to setup a search pull down which is hard coded to a particular site.

For example, add a menu item called

And what ever I put into the search window ends up going to google as


Anyone have any idea why apps are starting to search /proc/sys/vm?

<a href="" title=""></a>
<a href="" title=""></a>

As we develop SELinux we are adding new labels to homedir content

We have added file trans by name rules to policy to fix a lot of
files/directories being created with the correct label.

We have problems on Distribution updates (F16-F17) though, where there is a
files/directories in the homedir that are mislabeled.

We have "restorecond -u" which we run in F15/F16 which examines the homedir
and fixes any files directories it finds mislabeled in ~.

On F16 and F17 I am seeing lots of apps requiring access to /sys/devices/system/cpu/online

Anyone know what library is causing this?

type=AVC msg=audit(1322851411.945:2185): avc: denied { read } for
pid=1499 comm="dbus-daemon" name="online" dev=sysfs ino=34
tcontext=system_u:object_r:sysfs_t:s0 tclass=file
type=PATH msg=audit(1322851411.945:2185): item=0
name="/sys/devices/system/cpu/online" inode=34 dev=00:10 mode=0100444
ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sysfs_t:s0

I am running a rather locked down environment

I do not allow services to run on my desktop to listen on networks,
using SELinux user staff_t in rawhide.

Proposing Fedora Feature for private /tmp and /var/tmp for all systemd services in Fedora 17.

It seems to be a weekly occurrence of a new CVE for some app that uses
/tmp insecurely.

I have been on a crusade for years to stop privileged services from
using /tmp and /var/tmp. These services can be potentially be
interfered by unprivileged users, potentially leading to process
escalation. The only server applications that need to use /tmp
should be for communicating with users.

Did gtkhtml2 package disappear?

policycoreutils has broken dependencies in the rawhide tree:
On x86_64:
policycoreutils-gui-2.1.5-2.fc17.x86_64 requires gtkhtml2
On i386:
policycoreutils-gui-2.1.5-2.fc17.i686 requires gtkhtml2
Please resolve this as soon as possible.