Dustin C. Hatch
4261677265
All checks were successful
infra/dch-selinux/pipeline/head This commit looks good
dnf5 does not recognize the `--` argument to mean "end of arguments" like DNF 4 did. To terminate the argument list, we need to use the "and nothing" shell syntax.
Dustin's SELinux Policy Modules
This is a collection of SELinux policy modules that fix or augment the default SELinux policy for Fedora/RHEL.
dch-samba
The SELinux reference policy does not have rules for the Samba Active Directory
Domain Controller ("samba4"). On Fedora/RHEL, /usr/bin/samba runs in
unconfined_service_t. This is fine for the DC functionality itself, but
breaks winbindd. The refpolicy does have rules for winbind, but they expect
it to run in its own domain, winbind_t. Since winbindd is started by
samba when running on a DC, it runs in unconfined_service_t as well.
The dch-samba policy module adds a couple of rules to allow samba to launch
winbindd in the correct domain, and fixes up a few other AVC denials that
come from doing this.