Make installp more intelligent re: Trusted Executition policies - currently TE=ON prevents any actions with installp

installp process examines the TE policies before taking any action. Once the policy "TE=ON" any action to install or uninstall software is blocked.

The message is:
Installation cannot proceed as Trusted Execution Checks are enabled.
Disable the TE, TEP and TLP policies on system and try installing

Actually, TEP and TLP may both be set to OFF, and installp still fails. That is, just having TE=ON (and all other settings at default) prevents installation.

The real reason for looking at TE=ON is not for TE itself - which is merely a toggle for all policies active or inactive. It seems to be a short-cut for considering whether the file /etc/security/tsd/tsd.dat may be updated and/or "secured" files need to be modified (written to). These two specific cases are controlled by TSD_LOCK and TSD_FILES_LOCK respectively.

The request is to have installp look at the real policies that control this behavior (updating the tsd.dat file and/or installing/modifying files specified in the tsd.dat). When no modification to the TSD data is required the installp should proceed normally.

Note: installp should not (attempt) to disable TE policies. If there is an active policy that prevents modification of TSD - that should be stated clearly

Ideally, additional verbosity - maybe to syslog "auth.info" and/or errpt could name the specific file aka entry name that needs to be "open" before installp can proceed. The current message is too vague. Remains unclear why TLP and/or TEP have any affect on the install process - either the programs and libraries needed are available and it succeeds - or they are not - and it fails. If there are other explanations - this should be provided in clear documentation.

Additionally, when an installp package does not need to modify tsd.dat and/or contain a file with a digital signature (i.e., the cert_tag and signature tags are used) - the the installp "-a" and "-u" actions should complete normally - just as rpm options "-i" and "-e" succeed.)

Yes - installp should verify system integrity - but it should do it wisely and examine the installp packaging for indications that an update to the TSD is needed - rather than abort just because the "main-switch" TE=ON is true.