SELinux ddclient and ca-certificates

Robert Sharp <selinux-/[email protected]> Thu, 15 Jun 2017 11:58:49 +0100
Newsgroups	gmane.linux.gentoo.hardened
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--------------00F8DEF8A5D8204C6143FE42
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

I have been enforcingon my SELinux box for a while without incident, 
until yesterday. Ddclient started spamming me with emails about SSL 
connect failures. I checked the audit log for AVCs and found the one 
below. The context for /etc/ssl/certs/ca-certificates is cert_t and it 
looks like the interface needed to access this type is 
"miscfiles_manage_generic_cert_files". I can test if this is the right 
approach? May take a while cos I am not sure how to force ddclient into 
attempting an update.

Thanks,
Robert

|type=AVC msg=audit(1497448811.326:13013): avc: denied { search } for 
pid=3311 comm=6464636C69656E74202D20636F6E6E name="ca-certificates" 
dev="dm-0" ino=2630168 scontext=system_u:system_r:ddclient_t 
tcontext=system_u:object_r:cert_t tclass=dir permissive=0 |||


--------------00F8DEF8A5D8204C6143FE42
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <p><font face="Arial">I have been </font><font face="Arial">enforcing</font><font
        face="Arial"> on my SELinux box for a while without incident,
        until yesterday. Ddclient started spamming me with emails about
        SSL connect failures. I checked the audit log for AVCs and found
        the one below. The context for /etc/ssl/certs/ca-certificates is
        cert_t and it looks like the interface needed to access this
        type is "miscfiles_manage_generic_cert_files". I can test if
        this is the right approach? May take a while cos I am not sure
        how to force ddclient into attempting an update.<br>
      </font></p>
    <p><font face="Arial">Thanks,<br>
        Robert<br>
      </font></p>
    <pre><code>type=AVC msg=audit(1497448811.326:13013): avc:  denied  { search } for  pid=3311 
  comm=6464636C69656E74202D20636F6E6E name="ca-certificates" dev="dm-0" ino=2630168 
  scontext=system_u:system_r:ddclient_t tcontext=system_u:object_r:cert_t tclass=dir 
  permissive=0

</code><code>
</code></pre>
  </body>
</html>

--------------00F8DEF8A5D8204C6143FE42--