infra
/
dch-selinux
1
0
Fork 0
Code Packages
SELinux policy modules
3 Commits
1 Branch
0 Tags
44 KiB
Makefile 61.4%
Shell 38.6%
 
 
Go to file
Dustin 8c1eaf1bac meta: Publish to Gitea 
Gitea 1.20 introduced RPM package repository support.  We can use this
feature to publish the *dch-selinux* RPM, instead of manually creating
the repository and publishing it to the file server.  This will
ultimately enable Jenkins to publish the package as well.
 		2023-10-26 09:27:04 -05:00
.gitignore Add RPM spec 2023-10-26 09:24:10 -05:00
Makefile meta: Publish to Gitea 2023-10-26 09:27:04 -05:00
README.md Initial commit 2021-08-26 21:18:41 -05:00
dch-samba.fc Initial commit 2021-08-26 21:18:41 -05:00
dch-samba.if Initial commit 2021-08-26 21:18:41 -05:00
dch-samba.te Initial commit 2021-08-26 21:18:41 -05:00
dch-selinux.spec Add RPM spec 2023-10-26 09:24:10 -05:00

README.md

Dustin's SELinux Policy Modules

This is a collection of SELinux policy modules that fix or augment the default SELinux policy for Fedora/RHEL.

dch-samba

The SELinux reference policy does not have rules for the Samba Active Directory Domain Controller ("samba4"). On Fedora/RHEL, /usr/bin/samba runs in unconfined_service_t. This is fine for the DC functionality itself, but breaks winbindd. The refpolicy does have rules for winbind, but they expect it to run in its own domain, winbind_t. Since winbindd is started by samba when running on a DC, it runs in unconfined_service_t as well.

The dch-samba policy module adds a couple of rules to allow samba to launch winbindd in the correct domain, and fixes up a few other AVC denials that come from doing this.