fail2ban: need selinux help!

[Richard Shaw]

Due to a change in SELinux for Fedora 34 (I can't find the link right now),
the policy for fail2ban needs to be updated[1] but the changes are a little
bit beyond my understanding of SELinux.

Any help or pointers from an expert?

Thanks,
Richard

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1953321
https://bugzilla.redhat.com/show_bug.cgi?id=1953322
https://bugzilla.redhat.com/show_bug.cgi?id=1953323
https://bugzilla.redhat.com/show_bug.cgi?id=1953324
https://bugzilla.redhat.com/show_bug.cgi?id=1953325
https://bugzilla.redhat.com/show_bug.cgi?id=1943696

[Zdenek Pytela]

On Tue, May 25, 2021 at 2:01 PM Richard Shaw <hobbes1069(a)gmail.com&gt; wrote:

>  Due to a change in SELinux for Fedora 34 (I can't find the link
> right
>  now), the policy for fail2ban needs to be updated[1] but the changes are a
>  little bit beyond my understanding of SELinux.
>
>  Any help or pointers from an expert?
>  
Hi Robert,

There were a set of changes [1] adding new SELinux permissions in F34.
Fail2ban uses its own selinux policy which overrides the one distributed in
the selinux-policy package, so it needs to be addressed in the component. I
am helping with that [2]. I will take a look at those new bzs and suggest
additional changes, probably close some of them as dups.

[1]
https://fedoraproject.org/wiki/SELinux/Changes/Make_selinux_policy_uptoda...
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1943696


>  Thanks,
>  Richard
>
>  [1] https://bugzilla.redhat.com/show_bug.cgi?id=1953321
>  https://bugzilla.redhat.com/show_bug.cgi?id=1953322
>  https://bugzilla.redhat.com/show_bug.cgi?id=1953323
>  https://bugzilla.redhat.com/show_bug.cgi?id=1953324
>  https://bugzilla.redhat.com/show_bug.cgi?id=1953325
>  https://bugzilla.redhat.com/show_bug.cgi?id=1943696
>
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>  

-- 

Zdenek Pytela
Security SELinux team