Re: [gentoo-hardened] Re: "Out of the box" SELinux policy questions...

[Antoine Martin]

Mike Edenfield wrote:
> Chris PeBenito wrote:
>
>> It would be nice to find out more specifically what is going on with the
>> other two denials, but I suspect that it will be ok to allow.  I use
>> dhcpcd on my server, but don't see this problem.
>
> Thanks for all your help so far.  Over this weekend I upgraded to the
> new, modular SELinux policy and applied the strict policy to my system.
>  This seems to have removed the majority of my audit messages, so I'm
> guessing the 2005.1 policy files were just out of date.
>
> I do have a few questions about the new policy setup.
>
> 1. How can I see what policy rules are defined in a compiled policy
> module?  I need to add some rules to handle interactions between
> multiple services but I want to make sure the labels are correct first,
> and use the correct domain types.  But without the policy sources I
> haven't figured out how to see what rules are available.
for strict:
/usr/share/selinux/strict/
ie for services:
/usr/share/selinux/strict/include/services/

> 2. This one is specific to sudo.  I added a couple of rules relating to
> sudo:
>
> allow sysadm_sudo_t self:netlink_route_socket r_netlink_socket_perms;
> allow sysadm_sudo_t pam_var_run_t:dir { getattr search write };
>
> but I remember from looking through the older policy sources that sudo
> actually defines more than one $1_sudo_t type that all get the same
> rules.  Is there a way in my local.te file to look up and apply my two
> transition rules to every defined *_sudo_t type, or will I need to
> specify each one individually?
/usr/share/selinux/strict/include/admin/sudo.if

So you should be able to add it there.
I haven't figured out how to build from this location though, so I have 
done like you did and kept my changes to local modules. And in any case 
these changes would probably get lost on policy upgrade.

Which brings another question, how do I get simple policy changes 
merged? I've got a bunch of tweaks that I use here that other people 
will want to use eventually, like mysql support for postfix - a bit like 
the use flag:

allow postfix_$1_t mysqld_t:unix_stream_socket connectto;
allow postfix_$1_t mysqld_var_run_t:dir search;
allow postfix_$1_t mysqld_var_run_t:sock_file write;

Also, sorry to hijack the thread, but where can I enable 
apache_read_user_content?

Antoine
-- 
gentoo-hardened@g.o mailing list