<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div dir="auto"><br></div><blockquote class="tutanota_quote" style="border-left: 1px solid #93A3B8; padding-left: 10px; margin-left: 5px;"><div dir="auto">It might be worth submitting the policy to Fibocomm's github repo as a<br></div><div dir="auto">PR too.<br></div></blockquote><div dir="auto">Good idea! Might create a github account for that.</div><blockquote class="tutanota_quote" style="border-left: 1px solid #93A3B8; padding-left: 10px; margin-left: 5px;"><div dir="auto">I think that would be "audit2allow -a -R -m fibocomservices" and then<br></div><div dir="auto">you'll end up with a ".te" (type enforcement) file that you can put in<br></div><div dir="auto">the PR. It should look something like<br></div><div dir="auto">https://github.com/stefanberger/swtpm/blob/master/src/selinux/swtpm.te<br></div><div dir="auto"><br></div><div dir="auto">I'm a bit hazy on process of getting the .te file into something that<br></div><div dir="auto">can get shipped with a package; looking at some Fedora packages that<br></div><div dir="auto">ship SELinux policy looks more complicated than I recall. <br></div><div dir="auto"><br></div><div dir="auto">But the ".te" file is the start; would you be able to post that output<br></div><div dir="auto">here?<br></div></blockquote><div dir="auto">Sure, here are the contents of the .te file:<br></div><div dir="auto"><br></div><div dir="auto">policy_module(fibocomservices, 1.0)<br></div><div dir="auto"><br></div><div dir="auto">require {<br></div><div dir="auto">type modemmanager_t;<br></div><div dir="auto">type systemd_logind_t;<br></div><div dir="auto">type init_t;<br></div><div dir="auto">type user_home_t;<br></div><div dir="auto">class file { execute execute_no_trans open read };<br></div><div dir="auto">class msgq { associate create enqueue read unix_read unix_write write };<br></div><div dir="auto">class msg { receive send };<br></div><div dir="auto">class process setpgid;<br></div><div dir="auto">}<br></div><div dir="auto"><br></div><div dir="auto">#============= init_t ==============<br></div><div dir="auto">allow init_t self:msg { receive send };<br></div><div dir="auto">allow init_t self:msgq { associate create enqueue read unix_read unix_write write };<br></div><div dir="auto">allow init_t self:process setpgid;<br></div><div dir="auto">allow init_t user_home_t:file { execute execute_no_trans open read };<br></div><div dir="auto">unconfined_server_stream_connectto(init_t)<br></div><div dir="auto"><br></div><div dir="auto">#============= modemmanager_t ==============<br></div><div dir="auto">dmidecode_exec(modemmanager_t)<br></div><div dir="auto">unconfined_server_stream_connectto(modemmanager_t)<br></div><div dir="auto"><br></div><div dir="auto">#============= systemd_logind_t ==============<br></div><div dir="auto">systemd_dbus_chat_logind(systemd_logind_t)<br></div><div dir="auto"><br></div><blockquote class="tutanota_quote" style="border-left: 1px solid #93A3B8; padding-left: 10px; margin-left: 5px;"><div dir="auto"><br></div><div dir="auto">Good work; thanks for sticking with it!<br></div><div dir="auto"><br></div><div dir="auto">Dan<br></div></blockquote><div dir="auto">Thanks, of course! <br></div><div dir="auto">Jo<br></div><div dir="auto"><br></div> </body>
</html>