If this is just for debugging from time to time I think you could
simply log in the same directories where gssproxy has permission to
create ccache files under /var/lib, that would not require any changes
to the selinux policy afaik.
Sure it is not a log directory, but then, this is not intended for
regular logging either...
On Sun, 2022-03-06 at 17:23 -0500, Jacob Shivers wrote:
I recently was working on an issue that required looking at kerberos
functions below the gssapi layer. By setting KRB5_TRACE output I was
able to narrow down the issue.
To do this I created a drop file for the gssproxy systemd service
instead of starting the process at the command line. The drop file
designated KRB5_TRACE output to a file under /var/log. This testing
was on a system that uses SELinux so it was necessary to either create
a custom SELinux policy module or set SELinux to permissive.
The policy is relatively non-invasive:
(allow gssproxy_t var_log_t (dir ( write add_name )))
(allow gssproxy_t var_log_t (file ( create open )))
I am curious as to what others think about proper documentation.
Namely adding a small blurb to a man page or adding/extending a file
in gssproxy/docs. As there does not have to be a standard location to
direct the KRB5_TRACE output, I don't see it necessary to modify
selinux-policy with fixed entries.
gss-proxy mailing list -- gss-proxy(a)lists.fedorahosted.org
To unsubscribe send an email to gss-proxy-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
RHEL Crypto Team
Red Hat, Inc