Re: Adding SElinux support for a service

[Petr Lautrbach <lautrbach@redhat.com>]

Philip Prindeville <philipp_subx@redfish-solutions.com> writes:

>> On Nov 20, 2025, at 2:15 PM, Stephen Smalley <stephen.smalley.work@gmail.com> wrote:
>> 
>> On Thu, Nov 20, 2025 at 3:14 PM Philip Prindeville
>> <philipp_subx@redfish-solutions.com> wrote:
>>> 
>>> Hi,
>>> 
>>> I'm working on SElinux support for a server that talks to a PCIe GPS card.
>>> 
>>> Is there a guide to how to port a new service to SElinux, for instance how to give it its own context?  Or, in the absence of a guide, what GitHub project can I look at for the supporting commits that were done to achieve the same?
>> 
>> Can you elaborate a little on what it is you want to do? Do you have
>> SELinux enabled and enforcing already on the base system and just want
>> to add policy for a new service to confine it and/or control what
>> other processes can talk to it?
>> Or do you also want the service to be SELinux-aware, aka a userspace
>> object manager, where it enforces its own security policy over its own
>> objects and operations?
>> What's your starting point?
>
>
> Yes, I have an SElinux system (RHEL 10.0) and I’m running the daemon on it.  I want to package policy rules with the daemon, but yes, I also want to confine the daemon to its own context.
>
> Currently only chronyd or ntpd would talk to it, either by the char device it creates, or else the shared memory segment it creates.

Take a look at https://fedoraproject.org/wiki/SELinux/IndependentPolicy

Also given that this is for rpm based distro using fedora-selinux
policy, selinux@lists.fedoraproject.org might the better place to get a
help.

Petr