On Tuesday, 1 March 2022 08:01:02 AEDT Chris PeBenito wrote:
> > +# need SELinuxContext=system_u:system_r:mailman_cgi_t:s0 in the systemd
> > +# service file for the correct context on running /usr/bin/uwsgi for
> > +# mailman3-web
> > +corecmd_bin_entry_type(mailman_cgi_t)
>
> Why can't the label be changed for uwsgi?
Because uwsgi is a service program that may be used by many daemons.
> > allow mailman_mail_t self:capability { dac_override kill setgid setuid
> > sys_tty_config };>
> > -allow mailman_mail_t self:process { signal signull setsched };
> > +allow mailman_mail_t self:process { execmem signal signull setsched };
>
> Any idea why the execmem is hit?
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=913544
Mailman is mostly Python and function pointers in Python needs execmem, this
is used by the openssl Python library among other things.
> > Index: refpolicy-2.20220219/policy/modules/system/systemd.te
> > ===================================================================
> > --- refpolicy-2.20220219.orig/policy/modules/system/systemd.te
> > +++ refpolicy-2.20220219/policy/modules/system/systemd.te
> > @@ -1796,6 +1796,10 @@ optional_policy(`
> >
> > ')
> >
> > optional_policy(`
> >
> > + mailman_manage_lockdir(systemd_tmpfiles_t)
>
> There should be a systemd_tmpfilesd_managed(mailman_lock_t) in mailman.te
> instead.
OK, I'll make a new version with that change.
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
