Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
OpenRC and troubleshooting SELinux
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
feffe
n00b
n00b


Joined: 01 Mar 2019
Posts: 1

PostPosted: Fri Mar 01, 2019 10:19 pm    Post subject: OpenRC and troubleshooting SELinux Reply with quote

Hi,

I'm trying to enforce selinux on a my machines, but I'm having issues troubleshooting denials from init script. Currently I'm trying to get puppet to work.

The first issue is that the init-script wants to execute checkpath, but fails:

Code:

# rc-service puppet start
Authenticating feffe.
puppet            | * /var/log/puppetlabs/puppet: creating directory
puppet            | * checkpath: mkdir: Permission denied


The audit log gives no indication on why it was denied (even when disabling dontaudit using "semodule -DBR"), but in permissive mode it works. I've tried to add the following to a local policy, hoping that one of them would be correct, but no such luck:

Code:

manage_dirs_pattern(run_init_t, var_log_t, var_log_t)
manage_dirs_pattern(initrc_t, var_log_t, var_log_t)


There are more issues after this, but for now I would be happy if anyone can tell me what's going on in openrc, why can't I find the denials for checkpaths failure?

Edit:
Turns out checkpath runs as tmpfiles_t, which explains why the above didn't work. I've created bug #679234 with my findings regarding puppet.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum