Mike Edenfield wrote:
Chris PeBenito wrote:
It would be nice to find out more specifically what is going on with the
other two denials, but I suspect that it will be ok to allow. I use
dhcpcd on my server, but don't see this problem.
Thanks for all your help so far. Over this weekend I upgraded to the
new, modular SELinux policy and applied the strict policy to my system.
This seems to have removed the majority of my audit messages, so I'm
guessing the 2005.1 policy files were just out of date.
I do have a few questions about the new policy setup.
1. How can I see what policy rules are defined in a compiled policy
module? I need to add some rules to handle interactions between
multiple services but I want to make sure the labels are correct first,
and use the correct domain types. But without the policy sources I
haven't figured out how to see what rules are available.
for strict:
/usr/share/selinux/strict/
ie for services:
/usr/share/selinux/strict/include/services/
2. This one is specific to sudo. I added a couple of rules relating to
sudo:
allow sysadm_sudo_t self:netlink_route_socket r_netlink_socket_perms;
allow sysadm_sudo_t pam_var_run_t:dir { getattr search write };
but I remember from looking through the older policy sources that sudo
actually defines more than one $1_sudo_t type that all get the same
rules. Is there a way in my local.te file to look up and apply my two
transition rules to every defined *_sudo_t type, or will I need to
specify each one individually?
/usr/share/selinux/strict/include/admin/sudo.if
So you should be able to add it there.
I haven't figured out how to build from this location though, so I have
done like you did and kept my changes to local modules. And in any case
these changes would probably get lost on policy upgrade.
Which brings another question, how do I get simple policy changes
merged? I've got a bunch of tweaks that I use here that other people
will want to use eventually, like mysql support for postfix - a bit like
the use flag:
allow postfix_$1_t mysqld_t:unix_stream_socket connectto;
allow postfix_$1_t mysqld_var_run_t:dir search;
allow postfix_$1_t mysqld_var_run_t:sock_file write;
Also, sorry to hijack the thread, but where can I enable
apache_read_user_content?
Antoine
--
[email protected] mailing list
