Re: SELinux ddclient and ca-certificates

Robert Sharp <selinux-/[email protected]> Sat, 17 Jun 2017 18:20:40 +0100
Newsgroups	gmane.linux.gentoo.hardened
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--------------9808F8C88701207CC16FFE71
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

On 17/06/17 11:47, Sven Vermeulen wrote:
> I generally try to make sure that it is the right domain before adding the
> privilege. In the denial, the command that is being denied access is
> "ca-certificates". Is that a script from ddclient, or does ddclient trigger
> an (external) script and should we perhaps look at a potential domain
> transition here?

Hi and thanks for the reply.

I had assumed this was the file of that name in /etc/ssl/certs but your 
comment made me check the inode and I was wrong. It is actually a 
directory "/usr/share/ca-certificates" which also has the "cert_t" 
context. There is no script by that name associated with ddclient so I 
guess ddclient is trying to (via openssl) access this directory/path?

Robert


--------------9808F8C88701207CC16FFE71
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 17/06/17 11:47, Sven Vermeulen
      wrote:<br>
    </div>
    <blockquote cite="mid:[email protected]" type="cite">
      <pre wrap="">I generally try to make sure that it is the right domain before adding the
privilege. In the denial, the command that is being denied access is
"ca-certificates". Is that a script from ddclient, or does ddclient trigger
an (external) script and should we perhaps look at a potential domain
transition here?</pre>
    </blockquote>
    <p><font face="Arial">Hi and thanks for the reply.<br>
      </font></p>
    <p><font face="Arial">I had assumed this was the file of that name
        in /etc/ssl/certs but your comment made me check the inode and I
        was wrong. It is actually a directory
        "/usr/share/ca-certificates" which also has the "cert_t"
        context. There is no script by that name associated with
        ddclient so I guess ddclient is trying to (via openssl) access
        this directory/path?</font></p>
    <p><font face="Arial">Robert</font><br>
    </p>
  </body>
</html>

--------------9808F8C88701207CC16FFE71--