Bug 243302

Dan-

What is the current preferred way to fix this?

http://fedoraproject.org/wiki/PackagingDrafts/SELinux
a) file a bug against selinux-policy to include changes for this program
b) create a selinux subpackage
c) scriptlets - this makes rpmlint scream
d) other

Create a selinux subpackage and policy for this app.

If you use system-config-selinux go to policy modules and attempt to generate a
policy for this.  It is faily easy if you follow the instructions.

The changes are just file-context changes, not actual additional permissions
that httpd needs, so I'm not sure what a policy module would do for you. 
Specifically, you /could/ write a policy to give httpd additional permissions
for the original file contexts, but that would be a "bad thing", since I think
the original file context is default_t or something, and that would defeat a lot
of the protections that the httpd policy offers.

The better solution I think is to just ship a fixed file contexts for those
files to fit the existing httpd policy module.  Maybe I'm misinterpreting your
words, and this is actually what you meant.

In any event, is the way to do this to create a
/etc/selinux/targeted/contexts/files/file_contexts.mailgraph file that gets
installed with the rpm?

Thanks.

Created attachment 157328 [details]
Te file

Yes There are two possible solutions, one we label the files in such a way that
any random cgi script would have ra_sys_content_t to them, or we create a new
policy that would isolate and protect the data from other cgi scripts.	I think
this is the preferable solution, from a security standpoint.

Created attachment 157330 [details]
Interface File

Created attachment 157331 [details]
File context file

Dan, I was following the instructions at
http://fedoraproject.org/wiki/PackagingDrafts/SELinux/PolicyModules.

Under the "scriptlets" section, there is a note regarding condrestart and some
additional scripting that needs to be done.  I was not entirely clear on this
area, so I was hoping you could take a look at the changes I made before I push
anything out:

http://cvs.fedora.redhat.com/viewcvs/rpms/mailgraph/devel/mailgraph.spec?root=extras&r1=1.3&r2=1.4

I would eliminate the whole varient part.  You are not going to ship a different
version for strict/targeted/mls.  You will ship the same policy for all three.

Remove
	 # Explicitly allow transitions into the new domain
  	 /usr/sbin/setsebool %{name}_disable_trans 0 &> /dev/null || :
Disable_trans does not exist in FC7 and beyond.

I think you need a condrestart at the end of post.

BTW Did you write policy for the mailgraph executable?  The policy I sent was
only for cgi?  
In the postun since we do not have disable_trans, the equivalent would be 

chcon -t bin_t /usr/sbin/mailgraph
service ... condrestart

(In reply to comment #8)
> Remove
> 	 # Explicitly allow transitions into the new domain
>   	 /usr/sbin/setsebool %{name}_disable_trans 0 &> /dev/null || :
> Disable_trans does not exist in FC7 and beyond.
>
> In the postun since we do not have disable_trans, the equivalent would be 
> 
> chcon -t bin_t /usr/sbin/mailgraph
> service ... condrestart

Should the rpmlint error just be ignored?

E: mailgraph forbidden-selinux-command-in-%postun chcon

Well since you currently do not have policy for   /usr/sbin/mailgraph this is
not a problem.  Although, we might want to lookinto confining it.  

But you bring up a good point which we really do not have a good solution to.

The best approach would be

if XYZ Running:
     service XYZ stop
semodule -r XYZ
if XYZ was Running
     service XYZ start

chcon in the post scripts are frowned upon, since they usually will not survive
relabel and checking the file context versus the default will indicate problems.

mailgraph-1.14-1.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mailgraph'

mailgraph-1.14-1.fc7 has been pushed to the Fedora 7 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mailgraph'

mailgraph-1.14-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

mailgraph-1.14-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.