about a new policy file in SELinux!

[Sajed Miremadi]

Hi,

I have asked this question several times before but haven't got the answer
I really want.
I'll ask it again but more clearly:
Does anybody ever write a new policy file except those which is defult in
selinux(I mean those in /etc/security/selinux/src/policy/domains/program).
When I say a policy file I mean the files with ".te". For example there
are some for "ping","innd","tcpdump" and ... .
If someone has a .te file with this condition, I would be very glad if
he/she could send me that.

thanx,
Sajed

[Colin Walters]

On Thu, 2004-08-05 at 00:31 +0430, Sajed Miremadi wrote:
>  Hi,
>  
>  I have asked this question several times before but haven't got the answer
>  I really want.
>  I'll ask it again but more clearly:
>  Does anybody ever write a new policy file except those which is defult in
>  selinux(I mean those in /etc/security/selinux/src/policy/domains/program). 
Yes, of course.

>  When I say a policy file I mean the files with ".te". For
> example there
>  are some for "ping","innd","tcpdump" and ... .
>  If someone has a .te file with this condition, I would be very glad if
>  he/she could send me that. 
Every time someone posts a new .te file to selinux(a)tycho.nsa.gov, like
Russell's postgrey policy, they are in that condition.

I think the problem you are running into is that you need a .fc file
corresponding to each .te file in order for the .te file to be enabled.
For example, if you create domains/program/myprogram.te, you need to
also create file_contexts/program/myprogram.fc.

[Sajed Miremadi]

Thanx a lot,

>  On Thu, 2004-08-05 at 00:31 +0430, Sajed Miremadi wrote:
> > Hi,
> >
> > I have asked this question several times before but haven't got the
> > answer
> > I really want.
> > I'll ask it again but more clearly:
> > Does anybody ever write a new policy file except those which is defult
> > in
> > selinux(I mean those in
> > /etc/security/selinux/src/policy/domains/program).
>
>  Yes, of course.
>
> > When I say a policy file I mean the files with ".te". For example there
> > are some for "ping","innd","tcpdump" and ... .
> > If someone has a .te file with this condition, I would be very glad if
> > he/she could send me that.
>
>  Every time someone posts a new .te file to selinux(a)tycho.nsa.gov, like
>  Russell's postgrey policy, they are in that condition. 
So where can I get the .te files that are sent to selinux(a)tycho.nsa.gov?


>  I think the problem you are running into is that you need a .fc file
>  corresponding to each .te file in order for the .te file to be enabled.
>  For example, if you create domains/program/myprogram.te, you need to
>  also create file_contexts/program/myprogram.fc. 
Not actually,because I have created one for "who" command and added the
.fc file to but it doesn't work. So I really want a new .te file.

thanx again,
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>

[Russell Coker]

On Thu, 5 Aug 2004 15:52, "Sajed Miremadi" <miremadi(a)ce.sharif.edu&gt;
wrote:
>  > Every time someone posts a new .te file to
> selinux(a)tycho.nsa.gov, like
>  > Russell's postgrey policy, they are in that condition.
>
>  So where can I get the .te files that are sent to selinux(a)tycho.nsa.gov? 
You can subscribe to the list or read the list archives at 
http://marc.theaimsgroup.com/?l=selinux&r=1&w=2 .

>  Not actually,because I have created one for "who" command
> and added the
>  .fc file to but it doesn't work. So I really want a new .te file. 
Why does "who" need it's own policy?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Stephen Smalley]

On Wed, 2004-08-04 at 16:01, Sajed Miremadi wrote:
>  Hi,
>  
>  I have asked this question several times before but haven't got the answer
>  I really want.
>  I'll ask it again but more clearly:
>  Does anybody ever write a new policy file except those which is defult in
>  selinux(I mean those in /etc/security/selinux/src/policy/domains/program).
>  When I say a policy file I mean the files with ".te". For example there
>  are some for "ping","innd","tcpdump" and ... .
>  If someone has a .te file with this condition, I would be very glad if
>  he/she could send me that. 
Most of the .te files that are in the policy today were written from
scratch by external contributors and submitted on the NSA selinux
mailing list, then added to the example policy.  Looking at a historical
snapshot of the example policy from early 2001, there were only 40 .te
files in it, compared to > 180 .te files now.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency