Re: [gentoo-hardened] SELinux - courier-imap

[Chris PeBenito]

On Mon, 2007-08-06 at 12:05 +0200, julien.thomas@×××××××××××××.fr wrote:
> I knew (according to old posts on the list) that other people were
> interessted in these fixes, so the topic name modification !
>
> However, I still have a small problem that would prevent the whole
> thing from working :
>
> With shell operations like
> semanage fcontext -a -s system_u -t courier_var_run_t '/var/run/imapd.*'
> semanage fcontext -a -s system_u -t courier_var_run_t '/var/run/pop3.*'
> semanage fcontext -a -s system_u -t courier_authdaemon_var_run_t
> '/var/run/authdaemon?*
>
> and then a restorecon /var/run/*,
> the files are correctly labelled for courier-imap.
>
> But either when rebooting or after an unprecised amount of time (ie
> refreshing operations, maybe), the files are no more correctly
> labelled (var_run_t).
>
> So, it means that the daemons do not care about what I told and that
> they change the files type. How can this be fixed ?

Need files_pid_filetrans(courier_$1_t,courier_var_run_t,file) in the
template.  Fedora doesn't need this, since they have a /var/run/courier
that is already courier_var_run_t.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243