From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 525EBC433EF for ; Wed, 9 Mar 2022 04:54:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229461AbiCIEzI (ORCPT ); Tue, 8 Mar 2022 23:55:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55450 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229445AbiCIEzH (ORCPT ); Tue, 8 Mar 2022 23:55:07 -0500 Received: from smtp.sws.net.au (smtp.sws.net.au [144.76.241.179]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7F1C577AB7 for ; Tue, 8 Mar 2022 20:54:07 -0800 (PST) Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id C4F38FA80; Wed, 9 Mar 2022 15:54:02 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1646801643; bh=loGG2eEySs9nJRR/Zs+iTmSB3kwX6DXI8b4M+NeCQkI=; l=1531; h=From:To:Reply-To:Subject:Date:In-Reply-To:References:From; b=JUKeLWwHcN5DFyiim/DntO6Qkmb/NaWwWBx+uOzPbtTQAUOBteQMIbuBx8zwd/ita sWYe/YhFXu216a/PikgTfgTs+oJcJapkMPmCx5KtixptPw33sW30eIL+zYy/htz1KP U3awTRtgADN+qDIt6ql/ys74ok9XBrDFkr/oTe7M= Received: by xev.coker.com.au (Postfix, from userid 1001) id 07B1A176355F; Wed, 9 Mar 2022 15:53:58 +1100 (AEDT) From: Russell Coker To: selinux-refpolicy@vger.kernel.org, Chris PeBenito Reply-To: russell@coker.com.au Subject: Re: [PATCH] mailman3 V2.1 Date: Wed, 09 Mar 2022 15:53:57 +1100 Message-ID: <1846899.oGztph3vmi@xev> In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On Tuesday, 1 March 2022 08:01:02 AEDT Chris PeBenito wrote: > > +# need SELinuxContext=system_u:system_r:mailman_cgi_t:s0 in the systemd > > +# service file for the correct context on running /usr/bin/uwsgi for > > +# mailman3-web > > +corecmd_bin_entry_type(mailman_cgi_t) > > Why can't the label be changed for uwsgi? Because uwsgi is a service program that may be used by many daemons. > > allow mailman_mail_t self:capability { dac_override kill setgid setuid > > sys_tty_config };> > > -allow mailman_mail_t self:process { signal signull setsched }; > > +allow mailman_mail_t self:process { execmem signal signull setsched }; > > Any idea why the execmem is hit? https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=913544 Mailman is mostly Python and function pointers in Python needs execmem, this is used by the openssl Python library among other things. > > Index: refpolicy-2.20220219/policy/modules/system/systemd.te > > =================================================================== > > --- refpolicy-2.20220219.orig/policy/modules/system/systemd.te > > +++ refpolicy-2.20220219/policy/modules/system/systemd.te > > @@ -1796,6 +1796,10 @@ optional_policy(` > > > > ') > > > > optional_policy(` > > > > + mailman_manage_lockdir(systemd_tmpfiles_t) > > There should be a systemd_tmpfilesd_managed(mailman_lock_t) in mailman.te > instead. OK, I'll make a new version with that change. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/