sorry for the late reply.
>> dhcpd_admin(foreman_proxy_t, system_r)
>You would not have both of these within the same block.
>netutils_domtrans_ping implies netutils_exec_ping.
>You probably want this on all the time.
I see. Our domain spawns ping when verifying if a given IP address is
not live. My goal is to execute the ping in it's ping_t domain. So is my
understanding correct I only need to have:
>What types does foreman have to manage under dhcpd? We probably
>add interfaces for this.
We do read its configuration (/etc/dhcp) and read leases files. To do
DHCP reservations, we call the omshell utility to do the changes. I see
that omshell has bin_t on RHEL6.
You would need to re-write
interface. It's caused by
where we use
typeattribute $1 initrc_transition_domain;
Ok I will do this and rewrite it without the typeattribute then.
Is this on RHEL7? You don't need to have it in RHEL7 because of
systemd. We should probably re-write/fix this
init_t/initrc_t/unconfined_services_t concept in Fedora22.
We support both RHEL6 and RHEL7. I am using the conditionals approach
instead of git branches because we have just small bits which are
different in 6/7.
I'd appreciate if you can file a BZ for that (I am not really sure how
to word this :-) so I can link it in my policy as a comment. In future,
we can start using the modified _admin interface.
If you use RHEL6, you need to write own _admin() interface to make
working with tunable statement.
DHCP is not the only issue I have. We manage several services: TFTP,
DHCP, DNS and Puppet.
Here is my draft version of the policy (this is really a first cut):
From the line 167 I had to comment TFTP, DNS and DHCP because I hit
same errors. Can you help me identify what needs to be done in
Fedora or backpoted to RHEL7 so we can use those admin interfaces?
For the TFTP case, we only read/write the TFTP contents.
For the DNS case, we read configuration files, zone files and use rndc
utility to modify DNS entries (which already has an _exec_t type).
I've already described the DHCP case.
I'd appreciate any comments. I plan to send my result for review once it
is finished. Thanks.
Lukas #lzap Zapletal