Re: avc { module_request, relabelfrom }: openvpn->tun

[Mr Dash Four]

> koji.fedoraproject.org/koji but i guess its for f14, so instead:
> > > kernel_request_load_module(openvpn_t)
>
> create module that allows openvpn_t to request the kernel to load a module:
>
> mkdir ~/myopenvpn; cd ~/myopenvpn;
> echo "policy_module(myopenvpn, 1.0.0)" > myopenvpn.te;
> echo "gen_require(`" >> myopenvpn.te;
> echo "type openvpn_t;" >> myopenvpn.te;
> echo "')" >> myopenvpn.te;
> echo "kernel_request_load_module(openvpn_t)" >> myopenvpn.te;
> make -f /usr/share/selinux/devel/Makefile myopenvpn.pp
> sudo semodule -i myopenvpn.pp

That did the trick!

It was good that you've included this as a separate module so that I 
could test it, otherwise I had to patch and recompile the whole policy, 
then rebuild the image in order to test it and see whether it works.

I take it to make this a 'permanent' solution I have to patch and 
include 'kernel_request_load_module(openvpn_t)' in openvpn.te (forming 
part of the -44 policy), is that right?
> You can not define this rule for just a single particular module.

That's a pity, but I could live with that - auditd gives me a detailed 
info when a module is loaded, so I can trace this anyway, so no big loss.
> See if you can reproduce it. unconfined_t (you) transition to the rc
> script domain when you run an rc script, the rc script domain in turn
> runs the openvpn executables.
>
> So with that in mind why would openvpn need to relabel unconfined_t
> tun_sockets?

I take it this gets called only if loading of the tun/tap module fails. 
May be in a similar way as to when dac_* gets called - only in case the 
'normal' permissions are too restrictive.