selinux March 2021

selinux@lists.fedoraproject.org

6 participants
4 discussions

selinux-policy package versioning change
by Zdenek Pytela 31 Mar '21

31 Mar '21

Hi, We plan to change the versioning scheme of the selinux-policy packages. Based on a request to using tags in selinux-policy github repo, we discussed further actions and possible automation and decided to couple the tags with the package version, together with making a change for better comprehensibility. So far, the package version changed with branching a new Fedora release off rawhide (e. g. 3.14.6 to 3.14.7), and the release part of the NVR scheme was used for updates (3.14.7-1). After the change, the version would contain the Fedora branch number and the sequential number of the package in the branch (34.1), and the release part would be used only for changes in packaging (34.1-1). It would apply to Fedora 34 and newer. In github repo, tags matching the Fedora package version would be used (v34.1), pairing the latest commit in github with the latest commit in the package (34.1-1). We do not expect any impact to end users neither to developers unless the exact version was used somewhere. If there are no objections, we will make the change in a week time. Cheers, -- Zdenek Pytela SELinux team

3 4

Failed to resolve filecon statement
by Daniel Skip 23 Mar '21

23 Mar '21

I've gotten this message in the past with SElinux and was able to figure it out but since I've taken a few years break from SElinux and now just getting back into it.....I am stumped on how to fix the issue. Basically, I made a simple script and am trying to confine that simple script but have run into this error. Here is the full error: Failed to resolve filecon statement at /var/lib/selinux/targeted/tmp/modules/400/testscript/cil:39 /usr/sbin/semodule: Failed! I'll link you my files from Github. Everything is the same except I just changed the name from "myscript" to "testscript." Any help is greatly appreciated, thank you. https://github.com/dtdevore64/myscript

1 0

Why won't it let me transition from a staff_r role to a sysadm_r role?
by Daniel Skip 22 Mar '21

22 Mar '21

Every time I run the command "sudo id -Z" it still says I am in the staff_r role when I should be in the sysadm_r role because that's how I set it up in my /etc/sudoers file which looks like this: daniel ALL=(ALL) ROLE=sysadm_r TYPE=sysadm_t ALL Furthermore, can anyone tell me what the best way to utilize RBAC on the targeted policy would be? I was looking at using the secadm_r for only installing policy instead of letting any other role do that but it looks like that would only work if I transitioned my system to a MLS system. Any ideas or help would be greatly appreciated.

3 4

how to influence the label of files generated by an appliaction
by SZIGETVÁRI János 16 Mar '21

16 Mar '21

Dear Members, I am maintaining a SELinux policy module for an application (A) and one of its submodules (B). By now I have reached a point where all the rules seem to be in place, and both A and B processes transition to their respective process labels, and have their associated file types, the related permissions and file paths set up. My problem is that even though a process of B is running with the B process label, it is supposed to create some files and directories of its own under a directory that has a label related to A. The B process has the necessary rights to create those directories and files underneath the directory with the label belonging to A. The problem is that the files created by the process B will not be created with the file label belonging to B, but seem to inherit the label from the parent directory, that has a label belonging to A. This happens in spite of having the file contexts and paths set up correctly in the module's fc rules. So if I run restorecon on the files that were just created (by B, but have a label belonging to A), it will (re)set them to the file labels I intended them to have originally. How can I overcome this problem? This behavior causes an ugly logical flaw in the logical design of my SELinux modules. Thanks in advance for any help! Best Regards, János Szigetvári -- Janos SZIGETVARI RHCE, License no. 150-053-692 <https://www.redhat.com/rhtapps/verify/?certId=150-053-692> LinkedIn: linkedin.com/in/janosszigetvari E-mail: janos(a)szigetvari.com, jszigetvari(a)gmail.com Web: janos.szigetvari.com __@__˚V˚ Make the switch to open (source) applications, protocols, formats now: - windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice - msn -> jabber protocol (Pidgin, Google Talk) - mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2021