Re: [gentoo-hardened] SELinux - courier-imap

[Chris PeBenito]

On Fri, 2007-08-03 at 12:12 +0200, julien.thomas@×××××××××××××.fr wrote:
> Hi.
> The problems of courier-imap began to be solved ...
>
> (The previous post where labelled by "SELinux - network streams" but
> as I am more focused with courier-imap now, I though it was good to
> change the subject)
>
> However, here is the problem I have with file labelling :
>
> I put it /etc/security/selinx/file_contexts the following lines
> /var/run/impad.*  system_u:object_r:courier_var_run_t
> /var/run/pop3.*  system_u:object_r:courier_var_run_t
> /var/run/authdaemon.*  system_u:object_r:courier_var_run_t
>
> as the previous ones (/var/run/courier(/.*)?) where wrong.
>
> However, restorecon do not give the good contexts for these files
> (var_run_t). Besides, when the server are restarted or after let's say
> one hour,
> the files got the var_run_t context though I changed them with chcon.
>
> Where should I put this file_context information.
> (Do I have to add this I a QuickFix module ?)

You can either make a module with your customizations or you can use
semanage, e.g.

semanage fcontext -a -s system_u -t courier_var_run_t '/var/run/pop3.*'

I generally just use a local module with my customizations.

> for the other problem, It was due to transition problems.
> I have added the following lines :
> type_transition initrc_t courier_exec_t:process courier_tcpd_t;

This doesn't make sense, there already exists a courier_tcpd_exec_t.
Sounds like a file is mislabeled.

> type_transition courier_tcpd_t courier_authdaemon_exec_t:process
> courier_authdaemon_t;

I'd appreciate it if you would collect all of your fixes when you get
your system working, and send them to me so I can review them and
integrate it into the policy.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243