(Odd - I only saw my copy of this, not the one that went to the list) Mr Dash Four wrote: >> The way the Samba policy module does things is to define a specific >> directory for scripts: >> >> samba.fc: >> ... >> /var/lib/samba/scripts(/.*)? >> gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0) >> ... >> >> This way you keep the scripts separate from ordinary system binaries, >> they automatically get the correct type when installed from rpm, and you >> don't need to create a new file context every time you add a script. >> >OK, but my initial question still stands - both openvpn_t and >openvpn_sudo_t need to have access to this directory at least. So, if I >define a new script type I have to alter openvpn.te and make the >directory where the scripts are located (and their new domain!) >available/accessible to openvpn_t. I have to do the same with >openvpn_sudo_t as well. > >One other possible solution would be to leave the directory where this >scripts are as openvpn_etc_t, name the scripts with this new domain and >then alter the new module to have (read-only) access to openvpn_etc_t >and full access to this new domain for the scripts - in this way I am >not altering openvpn.te (which is part of the main policy), but I am >creating a potential security hole by granting this new domain >(openvpn_sudo_t) access to openvpn_etc_t which includes other (mainly >configuration) files, which belong to openvpn...not as straight-forward >is it? Or have I missed something? I wouldn't alter openvpn.te from refpolicy; I leave the standard stuff alone and create any extensions in a specific policy for my servers. It's not difficult to make new types accessible to openvpn_t - hey, I just discovered some new macros! This looks as if it ought to be close: openvpn_sudo.fc /var/lib/openvpn/scripts(/.*)? gen_context(system_u:object_r:openvpn_sudo_exec_t,s0) openvpn_sudo.te # Create types for script files and domain type openvpn_sudo_exec_t; type openvpn_sudo_t; files_type(openvpn_sudo_exec_t); domain_type(openvpn_sudo_t); # Allow openvpn_t to access and run the scripts exec_files_pattern(openvpn_t, openvpn_sudo_exec_t, openvpn_sudo_exec_t); # perhaps we also need one or both of these allow openvpn_sudo_t openvpn_etc_t:dir search_dir_perms; exec_files_pattern(openvpn_sudo_t, openvpn_sudo_exec_t, openvpn_sudo_exec_t); # Get openvpn_t to transition the scripts to the new domain domtrans_pattern(openvpn_t, openvpn_sudo_exec_t, openvpn_sudo_t); You put your scripts in /var/lib/openvpn/scripts. If the scripts are installed from rpm and openvpn_sudo policy is already loaded, they will automatically get the correct context. Otherwise you use restorecon -r /var/lib/openvpn/scripts once the policy is loaded. Assuming this works (I haven't tested it) to get your scripts accessible and running in the right context, you would then work out whatever access the scripts need to run, and add that to openvpn_sudo.te too. See /usr/share/selinux/devel/include/support for the domain transition and file permission macros. -- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
