{"comment":{"url":"https://api.github.com/repos/bigon/refpolicy-contrib/comments/15975102","html_url":"https://github.com/bigon/refpolicy-contrib/commit/ff6468bca1af30f18ce376b349dc8266c9be7cbf#commitcomment-15975102","id":15975102,"user":{"login":"doverride","id":6236265,"avatar_url":"https://avatars.githubusercontent.com/u/6236265?v=3","gravatar_id":"","url":"https://api.github.com/users/doverride","html_url":"https://github.com/doverride","followers_url":"https://api.github.com/users/doverride/followers","following_url":"https://api.github.com/users/doverride/following{/other_user}","gists_url":"https://api.github.com/users/doverride/gists{/gist_id}","starred_url":"https://api.github.com/users/doverride/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/doverride/subscriptions","organizations_url":"https://api.github.com/users/doverride/orgs","repos_url":"https://api.github.com/users/doverride/repos","events_url":"https://api.github.com/users/doverride/events{/privacy}","received_events_url":"https://api.github.com/users/doverride/received_events","type":"User","site_admin":false},"position":null,"line":null,"path":"","commit_id":"ff6468bca1af30f18ce376b349dc8266c9be7cbf","created_at":"2016-02-09T11:17:25Z","updated_at":"2016-02-09T11:17:25Z","body":"My dilemma here is that although this by itself is not a big deal to allow since it can only relabel to and from firewalld_etc_rw_t, it does not make sense to allow it and it looks stupid to allow it. (I will directly admit that in my personal policy i also allow this: https://github.com/DefenSec/dssp-contrib/blob/master/services/firewalld/policy.cil#L20\r\n\r\nI prefer we dontaudit this, just because it does not make sense to allow this and because allowing it looks stupid because it cannot relabelto/relabelfrom anything other than firewalld_etc_rw_t anyway.\r\n\r\nTo me this is just a bug in firewalld, and it should stick to its own business"}}