3:52 a.m.
I'm experimenting with a package that needs to have rsyslog write to a
named fifo pipe (so log data can be handed off from rsyslog to an
external program). As I see it the options are:
1) apologize to the user and tell them to disable SELinux (no thanks)
2) get Fedora SELinux policy to add an exception (best case scenario I think)
3) tell the user how to manually modify policy and update it (which
might then break the next SELinux policy gets updated/etc.).
Is there any official process/advice for this? Thanks in advance.
-Kurt
5:35 a.m.
On 30 May 2011 09:52, Kurt Seifried <kurt(a)seifried.org> wrote:
I'm experimenting with a package that needs to have rsyslog write
to a
named fifo pipe (so log data can be handed off from rsyslog to an
external program). As I see it the options are:
1) apologize to the user and tell them to disable SELinux (no thanks)
2) get Fedora SELinux policy to add an exception (best case scenario I think)
3) tell the user how to manually modify policy and update it (which
might then break the next SELinux policy gets updated/etc.).
Is there any official process/advice for this? Thanks in advance.
I've found in the past that Dan et al., are pretty quick to respond if
you file a bug request asking for a change in policy for packages I
maintain in Fedora.
Of course, there's also a fourth alternative which is to ship a
SElinux module for your application in the package itself. It seems
like there was some work towards a standard for that, which seems to
have stalled:
http://fedoraproject.org/wiki/PackagingDrafts/SELinux/PolicyModules
J.
5:39 a.m.
On 2011-05-30 02:52:57 AM, Kurt Seifried wrote:
I'm experimenting with a package that needs to have rsyslog write
to a
named fifo pipe (so log data can be handed off from rsyslog to an
external program). As I see it the options are:
1) apologize to the user and tell them to disable SELinux (no thanks)
2) get Fedora SELinux policy to add an exception (best case scenario I think)
3) tell the user how to manually modify policy and update it (which
might then break the next SELinux policy gets updated/etc.).
This sounds like a
good thing to have as an SELinux boolean, so you can
probably get that added to selinux-policy and then tell users of your
package to turn the boolean on.
Thanks,
Ricky
9:49 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/30/2011 04:52 AM, Kurt Seifried wrote:
I'm experimenting with a package that needs to have rsyslog write
to a
named fifo pipe (so log data can be handed off from rsyslog to an
external program). As I see it the options are:
1) apologize to the user and tell them to disable SELinux (no thanks)
2) get Fedora SELinux policy to add an exception (best case scenario I think)
3) tell the user how to manually modify policy and update it (which
might then break the next SELinux policy gets updated/etc.).
Is there any official process/advice for this? Thanks in advance.
-Kurt
I would just request the policy to be updated to allow this.
Which policy version/OS are you dealing with?
It should be a mere matter of labeling the fifo_file with the
appropriate label to allow syslog to write. The real question is who is
on the other end of the fifo file listing for syslog messages?
We probably would need to write policy for this app.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk3lAAoACgkQrlYvE4MpobOPeACgwpcmM8ITastd4pUFq0K0dcHi
x2AAmgKjHX7smj2U0ZbIaB7PWiTsxcam
=EiNE
-----END PGP SIGNATURE-----
4720
days inactive
4721
days old
3 comments
4 participants
participants (4)
-
Daniel J Walsh -
Jonathan Underwood -
Kurt Seifried -
Ricky Zhou