Re: [systemd-devel] SELinux type transition rule not working

2017-03-03 Thread Ian Pilcher
On 03/03/2017 02:19 PM, Simon Sekidde wrote: Thanks. Lets try to get a template going and we can help clean it up. I've been scrambling to get my home network setup (after migrating the main network server/router from CentOS 6 -> 7), so it's not surprise if things are a bit hacky right now.

Re: [systemd-devel] SELinux type transition rule not working

2017-03-03 Thread Simon Sekidde
- Original Message - > From: "Ian Pilcher" <arequip...@gmail.com> > To: "Simon Sekidde" <sseki...@redhat.com> > Cc: "Systemd" <systemd-devel@lists.freedesktop.org>, seli...@tycho.nsa.gov > Sent: Friday, March 3, 2017 2:32:54 PM

Re: [systemd-devel] SELinux type transition rule not working

2017-03-03 Thread Ian Pilcher
On 03/03/2017 10:45 AM, Simon Sekidde wrote: Ian do you have a copy of this custom policy somewhere? https://github.com/ipilcher/squoxy/blob/master/squoxy.te -- Ian Pilcher

Re: [systemd-devel] SELinux type transition rule not working

2017-03-03 Thread Simon Sekidde
.@poettering.net, > seli...@tycho.nsa.gov > Sent: Friday, March 3, 2017 11:01:59 AM > Subject: Re: [systemd-devel] SELinux type transition rule not working > > > > - Original Message - > > From: "Ian Pilcher" <arequip...@gmail.com> > &g

Re: [systemd-devel] SELinux type transition rule not working

2017-03-03 Thread Stephen Smalley
On Fri, 2017-03-03 at 09:36 -0600, Ian Pilcher wrote: > On 03/02/2017 12:12 AM, Jason Zaman wrote: > > > > On Wed, Mar 01, 2017 at 05:51:01PM -0600, Ian Pilcher wrote: > > > > > > On 03/01/2017 05:28 PM, Ian Pilcher wrote: > > > > > > > > Per Lennart's response, systemd *should* be honoring the

Re: [systemd-devel] SELinux type transition rule not working

2017-03-03 Thread Simon Sekidde
Friday, March 3, 2017 10:44:18 AM > Subject: Re: [systemd-devel] SELinux type transition rule not working > > On 03/02/2017 09:13 AM, Simon Sekidde wrote: > > I assume this would be a pid file? > > You assume correctly. > > > If so then what you are p

Re: [systemd-devel] SELinux type transition rule not working

2017-03-03 Thread Ian Pilcher
On 03/02/2017 09:13 AM, Simon Sekidde wrote: I assume this would be a pid file? You assume correctly. If so then what you are probably looking for is a filename_trans rule and will require a new interface in squid.if for this. Try something like interface(`squid_filetrans_named_content',`

Re: [systemd-devel] SELinux type transition rule not working

2017-03-03 Thread Ian Pilcher
On 03/02/2017 12:12 AM, Jason Zaman wrote: On Wed, Mar 01, 2017 at 05:51:01PM -0600, Ian Pilcher wrote: On 03/01/2017 05:28 PM, Ian Pilcher wrote: Per Lennart's response, systemd *should* be honoring the file context rules when creating the directory. It's almost as if the directory is being

Re: [systemd-devel] SELinux type transition rule not working

2017-03-02 Thread Simon Sekidde
- Original Message - > From: "Lennart Poettering" <lenn...@poettering.net> > To: "Ian Pilcher" <arequip...@gmail.com> > Cc: "Systemd" <systemd-devel@lists.freedesktop.org>, seli...@tycho.nsa.gov > Sent: Wednesday, March 1,

Re: [systemd-devel] SELinux type transition rule not working

2017-03-01 Thread Ian Pilcher
On 03/01/2017 05:28 PM, Ian Pilcher wrote: Per Lennart's response, systemd *should* be honoring the file context rules when creating the directory. It's almost as if the directory is being created with the proper context, but something is changing it after the fact. I have absolutely no idea

Re: [systemd-devel] SELinux type transition rule not working

2017-03-01 Thread Ian Pilcher
On 03/01/2017 04:28 PM, cgzones wrote: Can you try a transition from initrc_t or the interface I've added a rule for initrc_t (although I'm 99% sure that is no longer used under systemd): type_transition init_t var_run_t : dir squoxy_var_run_t "squoxy"; type_transition initrc_t var_run_t

Re: [systemd-devel] SELinux type transition rule not working

2017-03-01 Thread Lennart Poettering
On Wed, 01.03.17 15:40, Ian Pilcher (arequip...@gmail.com) wrote: > I am using systemd's RuntimeDirectory to create a directory for a > service. > >RuntimeDirectory=squoxy > > This causes systemd to create /run/squoxy before starting my service, > but I haven't been able to get the SELinux