selinux October 2014

selinux@lists.fedoraproject.org

15 participants
15 discussions

building selinux-policy from source on fedora core
by George Karakougioumtzis 15 Oct '14

15 Oct '14

Hi. As i am running fedora core 20 and the updates from rawhide are far than early ported to core i was wondering how to build it from source. Do i just follow the INSTALL guide? It seems it installs as refpolicy while i have targeted and mls or is it something non relevant? Do i have to change the directive module-store to source from direct in /etc/selinux/semanage.conf. Any other issues i should take care of?Thanks

1 0

Add a new boolean
by George Karakougioumtzis 11 Oct '14

11 Oct '14

Hi list. I think it would be nice to have an selinuxuser_udp_server boolean identical to the selinuxuser_tcp_server. Issuing an sesearch -b selinuxuser_tcp_server -AC would reveal little work to be done, but i dont know how much rules would have to be written to the main selinux policy. Its just a thought but i would like some feedback.

3 4

Tips for setting up a policy dev environment
by William 09 Oct '14

09 Oct '14

Hi, I regularly report issues with confined users in SELinux as I run as one on my day-to-day account. Sometimes I have contributed fixes to the policy, but this has been through fedpkg and diffs that doesn't really scale well. How do you (the main developers) setup your selinux policy, what git / repo do you use for it, how do you build it etc. Any tips would be appreciated so that I can setup a more "long lasting" environment and hopefully, get to contribute some more policy. -- William <william(a)firstyear.id.au>

3 3

Munin Policy
by Gabriele Pohl 06 Oct '14

06 Oct '14

Hi Miroslav, I don't understand, why this is not a bug: https://bugzilla.redhat.com/show_bug.cgi?id=1126403 Isn't there something missing in the Munin SELinux Policy? Thanks in advance for explanation and greetings, Gabriele

1 0

various programs communicating with SSSD
by Milos Malik 02 Oct '14

02 Oct '14

Hi all, I would like to ask for help to identify services / daemons / agents which communicate with SSSD. It seems that selinux-policy does not expect such a behavior in many cases. The idea struck me when Kyle Brantley filed following bug: * BZ#1147787 - zebra won't start when sssd is used due to selinux policy As you can see the problem is not limited to RHEL-7 only: * BZ#1148572 - SELinux prevents zebra from communicating with sssd Are there other services which would communicate with SSSD if SSSD was enabled ? # grep sss /etc/nsswitch.conf passwd: sss files shadow: sss files group: sss files # Let's skip those SELinux domains which are already allowed to communicate with SSSD. Following script helped me to narrow the set of possible candidates: for SCONTEXT in `seinfo -adomain -x | grep -v domain | sort` ; do COUNT=0 sesearch -s $SCONTEXT -t sssd_var_lib_t -c sock_file -p write -A -C | grep -q allow && let "COUNT += 1" sesearch -s $SCONTEXT -t sssd_var_lib_t -c dir -p search -A -C | grep -q allow && let "COUNT += 1" sesearch -s $SCONTEXT -t sssd_t -c unix_stream_socket -p connectto -A -C | grep -q allow && let "COUNT += 1" sesearch -s $SCONTEXT -t sssd_public_t -c file -p read -A -C | grep -q allow && let "COUNT += 1" sesearch -s $SCONTEXT -t sssd_public_t -c dir -p search -A -C | grep -q allow && let "COUNT += 1" echo "$SCONTEXT: $COUNT" done | grep -v ": 5" The fact that selinux-policy does not contain appropriate allow rules for domain X does not mean that domain X does not want to communicate with SSSD. It's likely that nobody tried that scenario with enabled SELinux before. So far I was able to reproduce AVCs in scenarios (on RHEL-7.0) when following domains communicated with SSSD: * openct_t * postgrey_t * drbd_t * sblim_gatherd_t * rhsmcertd_t * pkcsslotd_t * openvswitch_t * opensm_t * ddclient_t * mysqld_safe_t * conman_t * dnssec_trigger_t * ctdbd_t * nova_scheduler_t * nova_api_t * nova_network_t * nova_vncproxy_t * speech-dispatcher_t I hope this email will help me create a list of domains, which suffer from similar SELinux denials, and start a discussion about possible ways how is (could be) SSSD used in SELinux enabled environments. Milos Malik SELinux QE person Red Hat

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux October 2014