Re: SELinux and rkhunter

On Fri, Nov 25, 2016 at 02:01:51PM +0000, Robert Sharp wrote:
>    On 25/11/16 11:51, Jason Zaman wrote:
> 
> Ideally, rkhunter should just have a policy.
> It would need something like: cron_system_entry(rkhunter_t, rkhunter_exec_t)
> If you wanted to write one, basing it off the aide policy would probably
> help.
> [1]https://gitweb.gentoo.org/proj/hardened-refpolicy.git/tree/policy/modules/con
> trib/aide.te
> Its quite a simple policy, it pretty much just needs to read everything
> on disk.
> 
>    Well, I want to learn more about SELinux so writing and testing a
>    "proper" policy sounds like an idea. I will give it a go.

Yes, the cron policy in SELinux has two "modes": either you have user cron
jobs run as the users' domain, or as the cronjob_t one. System cronjobs will
always run with system_cronjob_t.

Both cronjob_t and system_cronjob_t are meant as a sort-of stepping stone
towards the proper policy domain, as otherwise these domains would need to
be made very permissive which is contrary to the approach we want to take
with SELinux.

Wkr,
	Sven Vermeulen