Hi,
I'm trying to work on getting mod_selinux into EPEL.
When testing this, I noticed the following denial:
type=AVC msg=audit(1438573551.889:484): avc: denied { setcurrent } for pid=4988 comm="httpd" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=process
What's the best approach to getting this into the selinux policy for rhel / mod_selinux? Should this be a boolean that you need to enable? Given the ability to change process context is powerful, I don't think it should be a default.
Or should mod_selinux have this as a boolean, and define some extra types to transition down into to help make this a more secure default?
Your advice is appreciated.
Sincerely,
On 08/03/2015 06:34 AM, William Brown wrote:
Hi,
I'm trying to work on getting mod_selinux into EPEL.
When testing this, I noticed the following denial:
type=AVC msg=audit(1438573551.889:484): avc: denied { setcurrent } for pid=4988 comm="httpd" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=process
What's the best approach to getting this into the selinux policy for rhel / mod_selinux? Should this be a boolean that you need to enable? Given the ability to change process context is powerful, I don't think it should be a default.
Or should mod_selinux have this as a boolean, and define some extra types to transition down into to help make this a more secure default?
Your advice is appreciated.
Sincerely,
What OS do you use? On Fedora, mod_selinux comes with own SELinux policy where it is allowed.
What OS do you use? On Fedora, mod_selinux comes with own SELinux policy where it is allowed.
I'm doing this on RHEL7, as I would like to get mod_selinux into EPEL.
Sincerely,
On Tue, 2015-08-04 at 08:44 +0930, William Brown wrote:
What OS do you use? On Fedora, mod_selinux comes with own SELinux policy where it is allowed.
I'm doing this on RHEL7, as I would like to get mod_selinux into EPEL.
I think this is the issue:
semodule -i BUILD/mod_selinux-2.4.4/mod_selinux.targeted.pp libsepol.print_missing_requirements: mod_selinux's global requirements were not met: type/attribute httpd_user_script_ro_t (No such file or directory). libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory). semodule: Failed!
So maybe there are some types in the mod_selinux policy module that don't exist yet in RHEL7, so as a result, the post install semodule -i is failing.
Not really sure what the best course of action is. The upstream appears to be dead so I can't report it there.
Would it be better to make a mod_selinux.centos.te and a mod_selinux.fedora.te that accommodates these differences? Or to put httpd_user_script_ro_t into RHEL7?
selinux@lists.fedoraproject.org