CFE 3.15 (community): RHEL8/SELinux oddity... but not always

Background: We're doing a sizeable project to pull our CFE installations up 
from 3.10 and non-MPF towards something higher and MPF.    Overall, it's 
going reasonably well.  On our main installation we are at 3.12/RHEL7 and 
3.15/RHEL8. with the hub also on 3.15/RHEL8.  We had a few interesting 
little adventures with SELinux, but we've now got that stabilised, with 
just a minimal amount of additional rules to handle things.

The issue.  We have a separate installation (gitlab repo; hub).  Our local 
policy for that broadly resembles the main installation in structure, 
although with a lot of differences in detail.  I've just started the 
equivalent exercise of trying to pull that also up from 3.10/non-MPF.  But 
my RHEL8/3.15 machines are seeing a big new SELinux problem that we never 
saw on the main installation: lots of SELinux errors for cf_serverd 
relating to "pgrep" (and, on the client, a similar set for "ps").  The 
resulting ".te" file that I generate (using the recommended "ausearch ... | 
audit2allow ..." is nearly 90 lines in length: so nearly 40 lines all of 
the form:

    allow cfengine_serverd_t NetworkManager_t:dir getattr;

(with the variation among the lines being in that "NetworkManager_t" 
component).

I've tried stripping out almost all of our local policy but it seems to 
make no difference.

I've also looked at "misc/selinux/cfengine-enterprise.te" in the CFE 
source; my lines (such as that above) appear (eyeball) to have no overlap.

Does this ring any bells with anyone?

(By the way, I had thought about trying 3.18 on this RHEL8. but that had a 
completely separate problem even before installation... the topic of 
another message.)

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/14eca8f4-de70-457b-96d0-2dad944f31e1n%40googlegroups.com.