Re: [CentOS-devel] Making the redhat selinux-policy repository
publicly available
by Zdenek Pytela
On Tue, Jul 11, 2023 at 10:37 PM Troy Dawson <tdawson(a)redhat.com> wrote:
> On Tue, Jul 11, 2023 at 12:50 PM Neal Gompa <ngompa13(a)gmail.com> wrote:
>
>> On Tue, Jul 11, 2023 at 9:31 AM Troy Dawson <tdawson(a)redhat.com> wrote:
>> >
>> > On Tue, Jul 11, 2023 at 4:28 AM Daan De Meyer <daan.j.demeyer(a)gmail.com>
>> wrote:
>> >>
>> >> Hi,
>> >>
>> >> It seems that the selinux-policy rpm is built from
>> >> git@gitlab.cee.redhat.com:SELinux/selinux-policy.git which seems to be
>> >> a redhat internal repository. More specifically, if I try to checkout
>> >> the commit listed in the selinux-policy spec
>> >> (
>> https://gitlab.com/redhat/centos-stream/rpms/selinux-policy/-/blob/c9s/se...
>> )
>> >> in the fedora-selinux repository cloned from github, I get an error
>> >> saying that the commit does not exist. It would be great if the
>> >> repository containing this commit was publicly available and open for
>> >> external contributors just like all the other packages in CentOS
>> >> Stream. Is it possible to make this happen?
>> >
>> >
>> > I'm not the selinux-policy maintainer, so I can't comment on where they
>> work on the selinux-policy source code.
>> >
>> > But this is how I get the sources, if that is what you are ultimately
>> looking for.
>> >
>> > centpkg clone selinux-policy
>> > cd selinux-policy
>> > centpkg sources
>> > or if you want to know where they really are
>> > centpkg -v sources
>> > This shows it to be coming from
>> >
>> https://sources.stream.centos.org/sources/rpms/selinux-policy/selinux-pol...
>> >
>> > The sources information is found in the sources file
>> >
>> https://gitlab.com/redhat/centos-stream/rpms/selinux-policy/-/blob/c9s/so...
>> >
>> > I know this isn't exactly what you asked for, but I hope it still helps.
>> >
>>
>> I think the idea is that having the Git repository in a public
>> location would allow the CentOS Hyperscale SIG to contribute to the
>> SELinux policy in a meaningful way.
>>
>
> Ah, ok. That makes sense.
> As I said, I'm not the maintainer so I don't know why it's where it is.
> So I'll step out of the conversation.
>
Hi,
I am one of the selinux-policy maintainers. Currently, repository for
Fedora is at github.com and RHEL sources are in an internal repo. We have
already discussed moving centos stream sources to some of the public
repositories, but it did not happen. Currently we are discussing it again,
there are a few options how to do so.
To get just the latest repository content, steps described by Troy should
work. Additionally, most of the upstream work is done in Fedora and anyway
every new commit should go to Fedora first, RHEL content is mostly a subset
of Fedora, there are very few differences.
--
Zdenek Pytela
Security SELinux team
1 month, 1 week
Okay to move cobbler SELinux policy into the cobbler package?
by Orion Poplawski
Would there be any objections to moving the cobbler SELinux policy into
the Fedora cobbler package as has been done with other packages?
--
Orion Poplawski
he/him/his - surely the least important thing about me
IT Systems Manager 720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion(a)nwra.com
Boulder, CO 80301 https://www.nwra.com/
6 months, 1 week
MongoDB
by lejeczek
Hi guys.
Anybody uses MongoDB on Centos?
I’ve just installed vanilla-default MongoDB (following
their official docs) and right away SELinux shows denials:
... SELinux is preventing /usr/bin/mongod from search access
on the directory
/var/lib/containers/storage/overlay-containers/fe6f1040c1373930efe68c777805ecd4c921631e3a87b8806af1fe0cdf266d8b/userdata/shm.
For complete SELinux messages run: sealert -l
5263cddc-183a-472b-9098-bf4599c8453c ...
What is Mongo’s business in checking such path (and there is
more paths)?
...
SELinux is preventing /usr/bin/mongod from search access on
the directory /var/lib/nfs/rpc_pipefs. For complete SELinux
messages run: sealert -l bc61357c-c100-4d44-a43a-5b90008b44b8
...
I refuse to believe (for now) that my Mongo is trojaned.
Many thanks, L.
6 months, 3 weeks
dac_override with Cobbler
by lejeczek
Hi guys.
I wonder if someone might have seen _cobbler_ trying to
claim this.
I've tried a few sebools but regardless SELinux denies cobbler:
#============= cobblerd_t ==============
allow cobblerd_t self:capability dac_override;
and from what I gather _dac_override_ is pretty big thing
and I wonder if _cobbler_ should have it.
many thanks, L.
6 months, 3 weeks
