On 08/31/2017 09:29 PM, Thomas Mueller wrote:
I could not find a usbguard policy altough the service runs as root.
I've created an initial policy to confine the usbguard daemon:
I encountered some problems:
* the daemon wants to manage it's usbguard-daemon.conf file. If the
usbguard-daemon process has no write access to /etc/usbguard-daemon.conf
it will quit immediately on service start. At least for servers I wan't
to manage the config with a config mgmt tool and not let usbguard itself
change it's config.
* server vs. desktop: the daemon provides an interface for desktop
applets or the usbuard cli to manipulate the rules and config. This is
desirable for a desktop but IMHO not for servers. what should be the
default? should the daemon be allowed to change its config/rules or not?
Thanks for Pull Request, I created copr repo with this policy for
testing purposes, if usbguard folks will finish testing usbguard policy,
I'll merge it and add into Fedora Rawhide selinux-policy package.
selinux mailing list -- selinux(a)lists.fedoraproject.org
To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
Software Engineer, Security Technologies
Red Hat, Inc.