[gentoo-hardened] Re: "Out of the box" SELinux policy questions...

[Mike Edenfield]

Chris PeBenito wrote:

> It would be nice to find out more specifically what is going on with the
> other two denials, but I suspect that it will be ok to allow.  I use
> dhcpcd on my server, but don't see this problem.

Thanks for all your help so far.  Over this weekend I upgraded to the 
new, modular SELinux policy and applied the strict policy to my system. 
  This seems to have removed the majority of my audit messages, so I'm 
guessing the 2005.1 policy files were just out of date.

I do have a few questions about the new policy setup.

1. How can I see what policy rules are defined in a compiled policy 
module?  I need to add some rules to handle interactions between 
multiple services but I want to make sure the labels are correct first, 
and use the correct domain types.  But without the policy sources I 
haven't figured out how to see what rules are available.

2. This one is specific to sudo.  I added a couple of rules relating to 
sudo:

allow sysadm_sudo_t self:netlink_route_socket r_netlink_socket_perms;
allow sysadm_sudo_t pam_var_run_t:dir { getattr search write };

but I remember from looking through the older policy sources that sudo 
actually defines more than one $1_sudo_t type that all get the same 
rules.  Is there a way in my local.te file to look up and apply my two 
transition rules to every defined *_sudo_t type, or will I need to 
specify each one individually?

--Mike
-- 
gentoo-hardened@g.o mailing list