Dustin C. Hatch
5a0e5de56a
All checks were successful
infra/dch-selinux/pipeline/head This commit looks good
* Use `matrix` to generate pipelines for multiple Fedora versions * Sign RPM packages using the Jenkins GPG key * Publish RPM files to *dch* repository on *files.pyrocufflink.blue* instead of Gitea (the latter cannot handle multiple releases of the same package)
Dustin's SELinux Policy Modules
This is a collection of SELinux policy modules that fix or augment the default SELinux policy for Fedora/RHEL.
dch-samba
The SELinux reference policy does not have rules for the Samba Active Directory
Domain Controller ("samba4"). On Fedora/RHEL, /usr/bin/samba runs in
unconfined_service_t. This is fine for the DC functionality itself, but
breaks winbindd. The refpolicy does have rules for winbind, but they expect
it to run in its own domain, winbind_t. Since winbindd is started by
samba when running on a DC, it runs in unconfined_service_t as well.
The dch-samba policy module adds a couple of rules to allow samba to launch
winbindd in the correct domain, and fixes up a few other AVC denials that
come from doing this.