Semanage for domain transitions

Semanage for domain transitions

[Martin Spinassi]

Hi list!


I'm trying to figure out how to make domain transition using semanage or
any userland command.

My problem is that I've just compiled a new version of memcached, and
configured it to use the sock file /tmp/memcached.sock, but httpd can't
write to it. The scontext is httpd_t, and the dcontext is tmp_t.

Probably later I'll make a context for memcached, but by now, I've just
find out that I don't really know how to make a domiain transition
without having to install selinux source policy, and that's something
that I'm really trying to avoid.

Any link/doc/tip is really appreciated.

Thanks!

Martin


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Semanage for domain transitions

[Stephen Smalley]

On Mon, 2010-05-03 at 13:49 -0300, Martin Spinassi wrote:
> Hi list!
> 
> 
> I'm trying to figure out how to make domain transition using semanage or
> any userland command.
> 
> My problem is that I've just compiled a new version of memcached, and
> configured it to use the sock file /tmp/memcached.sock, but httpd can't
> write to it. The scontext is httpd_t, and the dcontext is tmp_t.
> 
> Probably later I'll make a context for memcached, but by now, I've just
> find out that I don't really know how to make a domiain transition
> without having to install selinux source policy, and that's something
> that I'm really trying to avoid.
> 
> Any link/doc/tip is really appreciated.

You can create a local policy module without needing to install the
sources for the base policy.

In simplest form, this might look like:

$ cat mymemcached.te
policy_module(mymemcached, 1.0)
require {
	type httpd_t, tmp_t, httpd_tmp_t;
}
type_transition httpd_t tmp_t:sock_file httpd_tmp_t;
allow httpd_t httpd_tmp_t:sock_file { create open read write unlink };

$ make -f /usr/share/selinux/devel/Makefile mymemcached.pp
$ sudo semodule -i mymemcached.pp

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Semanage for domain transitions

[Martin Spinassi]

On Mon, 2010-05-03 at 13:23 -0400, Stephen Smalley wrote:
> On Mon, 2010-05-03 at 13:49 -0300, Martin Spinassi wrote:
> > Hi list!
> > 
> > 
> > I'm trying to figure out how to make domain transition using semanage or
> > any userland command.
> > 
> > My problem is that I've just compiled a new version of memcached, and
> > configured it to use the sock file /tmp/memcached.sock, but httpd can't
> > write to it. The scontext is httpd_t, and the dcontext is tmp_t.
> > 
> > Probably later I'll make a context for memcached, but by now, I've just
> > find out that I don't really know how to make a domiain transition
> > without having to install selinux source policy, and that's something
> > that I'm really trying to avoid.
> > 
> > Any link/doc/tip is really appreciated.
> 
> You can create a local policy module without needing to install the
> sources for the base policy.
> 
> In simplest form, this might look like:
> 
> $ cat mymemcached.te
> policy_module(mymemcached, 1.0)
> require {
> 	type httpd_t, tmp_t, httpd_tmp_t;
> }
> type_transition httpd_t tmp_t:sock_file httpd_tmp_t;
> allow httpd_t httpd_tmp_t:sock_file { create open read write unlink };
> 
> $ make -f /usr/share/selinux/devel/Makefile mymemcached.pp
> $ sudo semodule -i mymemcached.pp


Stephan,

Thank you for your mail!
You answered me, and also sent me the example! I really appreciate it.

It's working perfect now. 

Best regards,

Martin



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.