selinux February 2014

selinux@lists.fedoraproject.org

15 participants
22 discussions

Correct way to create /tmp files that can be used by other domains.
by Jayson Hurst 06 Feb '14

06 Feb '14

If my daemon creates a file in /tmp which is labelled with my domains tmp file context as follows: -rw-------. 1001 1000 unconfined_u:object_r:qasd_tmp_t:s0 /tmp/krb5cc_1001 other daemons such as sshd (which use kerberos) will need access to this file as well. Is there a way to grant that access from my policy without having to specify an exact allow rule for sshd? I am seeing audit messages about this from audit2why. type=AVC msg=audit(1391534896.381:2642): avc: denied { getattr } for pid=2070 comm="sshd" path="/tmp/krb5cc_1001" dev=dm-0 ino=281219 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:qasd_tmp_t:s0 tclass=file audit2allow gives me the following allow rule: allow sshd_t qasd_tmp_t:file { getattr unlink }; But I don't want to create specific allow rules like this if I can help it.

3 2

Jboss under SELinux?
by Maurizio Pagani 06 Feb '14

06 Feb '14

Hi everybody, I have a question: Is there an official policy for Application Server JBoss? I've a customers's project that need of SELinux, and he use Postgresql and JBoss. Thanks in advance. Maurizio Pagani

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux February 2014