Comments (11)
commented on August 15, 2024
That file is unreadable. There is some interactive community support on irc://chat.freenode.net/selinux
from refpolicy.
commented on August 15, 2024
it is unreadable....
[kcinimod@brutus Downloads]$ cat __MAC*/._nginx_fc.txt
Mac OS X 2ATTR$$com.apple.TextEncoding3com.apple.lastuseddate#PSCHcom.apple.maclY7com.apple.metadata:kMDLabel_gq7h5knoovvlajwwdrgtby56byutf-8;134217984`c,v}M
1z!h=vSy'RD'TZ@a Y5%di;Rt_\a [kcinimod@brutus Downloads]$ Cj[7όH}7clt'ȡj?֛
from refpolicy.
commented on August 15, 2024
o never mind i think i figured it out ...
add this to nginx.te:
init_daemon_domain(nginx_t, nginx_exec_t)
role system_r types nginx_t;
from refpolicy.
sule01u
commented on August 15, 2024
This should be OK😥
nginx_fc.txt
nginx_te.txt
nginx_if.txt
chcon_sh.txt
from refpolicy.
commented on August 15, 2024
yes I managed to read it... See solution above
from refpolicy.
commented on August 15, 2024
You might even be able to omit the role system_r types nginx_t; line as its probably implied with init_daemon_domain(nginx_t, nginx_exec_t) line
from refpolicy.
sule01u
commented on August 15, 2024
This allows me to configure the ‘allow’ policy according to the AVC of the audit.log, and to configure the new tag for nginx and access it successfully.
Thank you very much!
from refpolicy.
sule01u
commented on August 15, 2024
I want to specify some ports for my nginx process , but the configuration of nginx_port_t doesn't seem to work. How do I configure the port label belonging to nginx
from refpolicy.
commented on August 15, 2024
Suleo Wang <[email protected]> writes:
I want to specify some ports for my nginx process , but the configuration of nginx_port_t doesn't seem
to work. How do I configure the port label belonging to nginx
Not sure what you mean but try this:
cat > mytest.te <<EOF
policy_module(mytest,1.0,0)
type nginx_port_t;
corenet_port(nginx_port_t)
EOF
make -f /usr/share/selinux/devel/Makefile mytest.pp
sudo semodule -i mytest.pp
sudo semanage port -a -t nginx_port_t -p tcp 5555
sudo seinfo --portcon | grep nginx
…
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or unsubscribe.
--
gpg --locate-keys [email protected]
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098
https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098
Dominick Grift
from refpolicy.
sule01u
commented on August 15, 2024
Yes, I am missing corenet_port(nginx_port_t). Where can I find the complete documentation for the custom SELinux tag?Writing SELinux tags as a novice is difficult!
from refpolicy.
commented on August 15, 2024
Suleo Wang <[email protected]> writes:
Yes, I am missing corenet_port(nginx_port_t). Where can I find the complete documentation for the
custom SELinux tag?Writing SELinux tags as a novice is difficult!
The reference policy makefile has a "make docs" build target which will
create "interface reference" html that can be used to peruse the API.
Eventually though the challenge of interpretting selinux policy is not reference
policy specific. One should ideally be able to interpret any selinux policy and
this requires two things:
1. one should know the SELinux policy language (the language is
documented here: https://github.com/SELinuxProject/selinux-notebook)
2. one should know how to use the setools policy analysis suite to get
answer to any selinux policy specific questions (the setools suite is
ther https://github.com/SELinuxProject/setools)
Once you can interpret the selinux policy language and once you are
familiar with setools you will be able to use those skills to find answers to any questions
related to any given selinux policy.
…
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or unsubscribe.
--
gpg --locate-keys [email protected]
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098
https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098
Dominick Grift
from refpolicy.
Related Issues (20)
- Fail to build with POLICY_TYPE MLS HOT 1
- Fail to build policy fapolicyd if DIRECT_INITRC=y HOT 3
- Q:java based application HOT 5
- Problem when building policy HOT 3
- libsepol.validate_user_datum: Invalid user datum HOT 4
- How to write modules for systemd user services? HOT 7
- libsepol.sepol_string_to_security_class: unrecognized class user_namespace HOT 4
- chrome->nacl_helper: user_namespace HOT 2
- 2 questions HOT 1
- Need help with transitions HOT 1
- Container issues in enforcing mode on Debian 12 HOT 13
- How to transfer the current process or its thread to another context? HOT 4
- Possible missing rule for ssh -> java HOT 2
- Debian 12.1 statd and mountd fail to start with fixed ports HOT 13
- Question: sudo HOT 5
- [Q] Permission cmd in class io_uring not defined in policy. HOT 3
- /root directory has no label specified HOT 4
- systemd v255 executor helper
- Information Disclosure vulnerability related to SSL Private Keys and CSR used by the HTTP daemon HOT 2
- Privileged container spc_t optional HOT 11
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from refpolicy.