Re: SELinux ddclient and ca-certificates

On Sat, Jun 17, 2017 at 06:20:40PM +0100, Robert Sharp wrote:
>    I had assumed this was the file of that name in /etc/ssl/certs but your
>    comment made me check the inode and I was wrong. It is actually a
>    directory "/usr/share/ca-certificates" which also has the "cert_t"
>    context. There is no script by that name associated with ddclient so I
>    guess ddclient is trying to (via openssl) access this directory/path?

The context on that directory is correct. If it is indeed ddclient that is
trying to manipulate that directory content, then by all means, add in the
privilege to do so.

Now, if I look at the current description of ddclient (i.e. perl client used
to update dynamic DNS entries) then I personally wonder if ddclient is
actually trying to *manipulate* the certificates (or add certificates to it)
rather than just use it.

It's okay to use it. Manipulating the directory seems to be something I
would want to verify with the application itself first. If it is a Perl
script, then it might be easy to find out why.

Wkr,
	Sven Vermeulen