From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81B80C433EF for ; Mon, 14 Mar 2022 13:56:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230109AbiCNN5d (ORCPT ); Mon, 14 Mar 2022 09:57:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43876 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229833AbiCNN5d (ORCPT ); Mon, 14 Mar 2022 09:57:33 -0400 Received: from smtp.sws.net.au (smtp.sws.net.au [IPv6:2a01:4f8:201:1e6::dada:cafe]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D602D46664 for ; Mon, 14 Mar 2022 06:56:22 -0700 (PDT) Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id D51DDF1F0; Tue, 15 Mar 2022 00:56:18 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1647266179; bh=vnb3MK8CCLd3E3FaorL8sVDPS8vqtnoGOVIDAskkINo=; l=666; h=From:To:Reply-To:Subject:Date:In-Reply-To:References:From; b=IZmWPmoUq27arIRLXPQbV5WT6bT7rffnSxZ/MFwedK6ZFrrZwKMuTH2nmGpcABozO NI/FfbnJ44YIkcQyLE6GTpDzM9kKGxUuJjMZTR3ecV61WdoEB7Wbjb1AZam9+fccOH Eo7RjlOZnXdmX7jmweOMerRYZ6cPWuApWoP8s1ss= Received: by xev.coker.com.au (Postfix, from userid 1001) id 061FC177302D; Tue, 15 Mar 2022 00:56:14 +1100 (AEDT) From: Russell Coker To: selinux-refpolicy@vger.kernel.org, Chris PeBenito Reply-To: russell@coker.com.au Subject: Re: [PATCH] certbot V2 Date: Tue, 15 Mar 2022 00:56:13 +1100 Message-ID: <2933855.8EzMN8LN0u@xev> In-Reply-To: <736887c7-d588-8562-4933-030947915fe2@ieee.org> References: <736887c7-d588-8562-4933-030947915fe2@ieee.org> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On Tuesday, 15 March 2022 00:53:14 AEDT Chris PeBenito wrote: > > -logging_search_logs(certbot_t) > > +logging_log_filetrans(certbot_t, certbot_log_t, dir, "letsencrypt") > > I don't see any conflicting type_transitions here or above. If there are > none, then the letsencrypt should be removed. Do we want to allow it to create whatever directories it likes under /var/log? What if it decides to create something else inappropriately? There aren't any conflicts, just an issue of whether we want to allow it unrestricted write access to an important directory. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/