Re: [PATCH] mailman3 V2.1

[Russell Coker <russell@coker.com.au>]

On Tuesday, 1 March 2022 08:01:02 AEDT Chris PeBenito wrote:
> > +# need SELinuxContext=system_u:system_r:mailman_cgi_t:s0 in the systemd
> > +# service file for the correct context on running /usr/bin/uwsgi for
> > +# mailman3-web
> > +corecmd_bin_entry_type(mailman_cgi_t)
> 
> Why can't the label be changed for uwsgi?

Because uwsgi is a service program that may be used by many daemons.

> >   allow mailman_mail_t self:capability { dac_override kill setgid setuid
> >   sys_tty_config };> 
> > -allow mailman_mail_t self:process { signal signull setsched };
> > +allow mailman_mail_t self:process { execmem signal signull setsched };
> 
> Any idea why the execmem is hit?

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=913544

Mailman is mostly Python and function pointers in Python needs execmem, this 
is used by the openssl Python library among other things.

> > Index: refpolicy-2.20220219/policy/modules/system/systemd.te
> > ===================================================================
> > --- refpolicy-2.20220219.orig/policy/modules/system/systemd.te
> > +++ refpolicy-2.20220219/policy/modules/system/systemd.te
> > @@ -1796,6 +1796,10 @@ optional_policy(`
> > 
> >   ')
> >   
> >   optional_policy(`
> > 
> > +	mailman_manage_lockdir(systemd_tmpfiles_t)
> 
> There should be a systemd_tmpfilesd_managed(mailman_lock_t) in mailman.te
> instead.

OK, I'll make a new version with that change.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/