On 05/04/2014 12:22 AM, Emmanuel Noobadmin wrote:

Using Fedora 20 3.11.10-301.fc20.x86_64 and selinux targeted policy.29

I've a PHP application that sends data to a USB tty device e.g. /dev/usbDataCollector

Unfortunately selinux is blocking this action. When set to permissive, the alert browser suggests the command: setsebool -P daemons_use_tty 1

The documentation says Allow all daemons the ability to use unallocated ttys. This naturally doesn't sound like a good idea although admittedly it probably won't hurt in this particular installation. However, I thought it would be good to find the 'correct' solution to this.

But I am unable to find a more fine grain SELinux control for this, Fedora 20 has no documentation and the only vaguely relevant one I could find elsewhere is httpd_tty_com which appears unrelated as it is about allow httpd to communicate with terminal.

So the question is whether there is any way to do this or is allowing all daemons the only option?

Simplest would be to just use # grep usbDataCollector /var/log/audit/audit.log | audit2allow -M myhttp # semodule -i myhttp.pp

This would allot httpd_t processes the ability to use usb_device_t. If you really wanted to tighten it up, you could build a custom policy that put a different label on /dev/usbDataCollector and allow httpd_t access to this device.

Something like

# cat myhttp.te policy_module(myhttp, 1.0) gen_require(` type httpd_t; ')

type httpd_device_t; dev_node(httpd_device_t)

allow httpd_t httpd_device_t:chr_file rw_chr_file_perms;

# cat myhttpd.fc /dev/usbDataCollector -c gen_context(system_u:object_r:httpd_device_t,s0)

# make -f /usr/share/selinux/devel/Makefile # semodule -i myhttp.pp # restorecon -v /dev/usbDataCollector