Adding SElinux support for a service

Adding SElinux support for a service

[Philip Prindeville]

Hi,

I'm working on SElinux support for a server that talks to a PCIe GPS card.

Is there a guide to how to port a new service to SElinux, for instance how to give it its own context?  Or, in the absence of a guide, what GitHub project can I look at for the supporting commits that were done to achieve the same?

Thanks,

-Philip

Re: Adding SElinux support for a service

[Stephen Smalley]

On Thu, Nov 20, 2025 at 3:14 PM Philip Prindeville
<philipp_subx@redfish-solutions.com> wrote:
>
> Hi,
>
> I'm working on SElinux support for a server that talks to a PCIe GPS card.
>
> Is there a guide to how to port a new service to SElinux, for instance how to give it its own context?  Or, in the absence of a guide, what GitHub project can I look at for the supporting commits that were done to achieve the same?

Can you elaborate a little on what it is you want to do? Do you have
SELinux enabled and enforcing already on the base system and just want
to add policy for a new service to confine it and/or control what
other processes can talk to it?
Or do you also want the service to be SELinux-aware, aka a userspace
object manager, where it enforces its own security policy over its own
objects and operations?
What's your starting point?

Re: Adding SElinux support for a service

[Philip Prindeville]

> On Nov 20, 2025, at 2:15 PM, Stephen Smalley <stephen.smalley.work@gmail.com> wrote:
> 
> On Thu, Nov 20, 2025 at 3:14 PM Philip Prindeville
> <philipp_subx@redfish-solutions.com> wrote:
>> 
>> Hi,
>> 
>> I'm working on SElinux support for a server that talks to a PCIe GPS card.
>> 
>> Is there a guide to how to port a new service to SElinux, for instance how to give it its own context?  Or, in the absence of a guide, what GitHub project can I look at for the supporting commits that were done to achieve the same?
> 
> Can you elaborate a little on what it is you want to do? Do you have
> SELinux enabled and enforcing already on the base system and just want
> to add policy for a new service to confine it and/or control what
> other processes can talk to it?
> Or do you also want the service to be SELinux-aware, aka a userspace
> object manager, where it enforces its own security policy over its own
> objects and operations?
> What's your starting point?


Yes, I have an SElinux system (RHEL 10.0) and I’m running the daemon on it.  I want to package policy rules with the daemon, but yes, I also want to confine the daemon to its own context.

Currently only chronyd or ntpd would talk to it, either by the char device it creates, or else the shared memory segment it creates.

Re: Adding SElinux support for a service

[Petr Lautrbach]

Philip Prindeville <philipp_subx@redfish-solutions.com> writes:

>> On Nov 20, 2025, at 2:15 PM, Stephen Smalley <stephen.smalley.work@gmail.com> wrote:
>> 
>> On Thu, Nov 20, 2025 at 3:14 PM Philip Prindeville
>> <philipp_subx@redfish-solutions.com> wrote:
>>> 
>>> Hi,
>>> 
>>> I'm working on SElinux support for a server that talks to a PCIe GPS card.
>>> 
>>> Is there a guide to how to port a new service to SElinux, for instance how to give it its own context?  Or, in the absence of a guide, what GitHub project can I look at for the supporting commits that were done to achieve the same?
>> 
>> Can you elaborate a little on what it is you want to do? Do you have
>> SELinux enabled and enforcing already on the base system and just want
>> to add policy for a new service to confine it and/or control what
>> other processes can talk to it?
>> Or do you also want the service to be SELinux-aware, aka a userspace
>> object manager, where it enforces its own security policy over its own
>> objects and operations?
>> What's your starting point?
>
>
> Yes, I have an SElinux system (RHEL 10.0) and I’m running the daemon on it.  I want to package policy rules with the daemon, but yes, I also want to confine the daemon to its own context.
>
> Currently only chronyd or ntpd would talk to it, either by the char device it creates, or else the shared memory segment it creates.

Take a look at https://fedoraproject.org/wiki/SELinux/IndependentPolicy

Also given that this is for rpm based distro using fedora-selinux
policy, selinux@lists.fedoraproject.org might the better place to get a
help.

Petr