Re: Selinux policy for beanstalkd

[Ruben Kerkhof]

On Jan 18, 2010, at 6:28 PM, Dominick Grift wrote:

>  On 01/17/2010 06:25 PM, Ruben Kerkhof wrote:
> > Hi list,
> >
> > I haven't written an selinux module before, so to start simple I
> > created one for beanstalkd, since we use this a lot.
> >
> > I'm running into one issue though:
> >
> > beanstalkd has the ability to create binary log files in
> > /var/lib/beanstalkd/binlog.
> > This directory doesn't exist by default, but it is created in the  
> > init script.
> >
> > Starting up beanstalkd creates an AVC denial:
> > type=AVC msg=audit(1263749015.682:199): avc:  denied  { create } for
> > pid=2163 comm="mkdir" name="beanstalkd"
> > scontext=unconfined_u:system_r:initrc_t:s0
> > tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir
> > type=SYSCALL msg=audit(1263749015.682:199): arch=c000003e syscall=83
> > success=no exit=-13 a0=7fff4e491f7b a1=1ed a2=7fff4e490770
> > a3=7fff4e4902c0 items=0 ppid=2156 pid=2163 auid=500 uid=0 gid=0  
> > euid=0
> > suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=6 comm="mkdir"
> > exe="/bin/mkdir" subj=unconfined_u:system_r:initrc_t:s0 key=(null)
> >
> > How do I allow the init script to do mkdir -p /var/lib/beanstalkd/ 
> > binlog?
>
>  Ask whoever packaged it to install the directory instead of letting  
>  the
>  init script create it. 
That certainly seems the easiest way, thanks. I'll file a bug.

>  Your beanstalk_admin could use a:
>
>  files_search_var_lib($1)
>  admin_pattern($1, beanstalkd_var_lib_t, beanstalk_var_lib_t) 
I presume this means that someone in the 'admin' role has the rights  
to manage stuff in /var/lib/beanstalkd?
Do I have to setup roles to test this?

>  You will need to require the beanstalkd_var_lib_t type as well
>
>  Other then that, looks good to me. 
Thanks for your help,

Ruben