Re: [gentoo-hardened] Re: "Out of the box" SELinux policy questions...

[Chris PeBenito]

On Thu, 2007-03-22 at 00:08 +0000, Antoine Martin wrote:
> Mike Edenfield wrote:
> > 2. This one is specific to sudo.  I added a couple of rules relating to
> > sudo:
> >
> > allow sysadm_sudo_t self:netlink_route_socket r_netlink_socket_perms;
> > allow sysadm_sudo_t pam_var_run_t:dir { getattr search write };
> >
> > but I remember from looking through the older policy sources that sudo
> > actually defines more than one $1_sudo_t type that all get the same
> > rules.  Is there a way in my local.te file to look up and apply my two
> > transition rules to every defined *_sudo_t type, or will I need to
> > specify each one individually?
> /usr/share/selinux/strict/include/admin/sudo.if
>
> So you should be able to add it there.
> I haven't figured out how to build from this location though, so I have
> done like you did and kept my changes to local modules. And in any case
> these changes would probably get lost on policy upgrade.

No, these should be treated like the headers in /usr/include; you
shouldn't be modifying them.  Changes to these policy modules will only
affect modules built from these headers, not to those modules that are
already built.

> Which brings another question, how do I get simple policy changes
> merged? I've got a bunch of tweaks that I use here that other people
> will want to use eventually, like mysql support for postfix - a bit like
> the use flag:
>
> allow postfix_$1_t mysqld_t:unix_stream_socket connectto;
> allow postfix_$1_t mysqld_var_run_t:dir search;
> allow postfix_$1_t mysqld_var_run_t:sock_file write;

Merged where?  To the Gentoo policy?

> Also, sorry to hijack the thread, but where can I enable
> apache_read_user_content?

Not sure what you mean by this.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243