Re: dac_override with Cobbler

--===============0602304151039066974==
Content-Type: multipart/alternative; boundary="0000000000000503b80609301717"

--0000000000000503b80609301717
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Nov 2, 2023 at 6:18=E2=80=AFPM lejeczek <[email protected]> wrote=
:

> Hi guys.
>
> I wonder if someone might have seen _cobbler_ trying to claim this.
> I've tried a few sebools but regardless SELinux denies cobbler:
>
> #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D cobblerd_t =3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D
> allow cobblerd_t self:capability dac_override;
>
> and from what I gather _dac_override_ is pretty big thing and I wonder if
> _cobbler_ should have it.
>
Hi,

If you can reproduce it, use one of the debugging option to find out access
to which file triggers it:
https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing


> many thanks, L.
> _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[email protected]=
.org
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>


--=20

Zdenek Pytela
Security SELinux team

--0000000000000503b80609301717
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote">=
<div dir=3D"ltr" class=3D"gmail_attr">On Thu, Nov 2, 2023 at 6:18=E2=80=AFP=
M lejeczek &lt;<a href=3D"mailto:[email protected]">[email protected]</=
a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0p=
x 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u=
></u>

 =20

   =20
 =20
  <div>
    <font size=3D"2" face=3D"Courier 10 Pitch">Hi guys.<br>
      <br>
      I wonder if someone might have seen _cobbler_ trying to claim
      this.<br>
      I&#39;ve tried a few sebools but regardless SELinux denies cobbler:<b=
r>
      <br>
      #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D cobblerd_t =3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
      allow cobblerd_t self:capability dac_override;<br>
      <br>
      and from what I gather _dac_override_ is pretty big thing and I
      wonder if _cobbler_ should have it.<br></font></div></blockquote><div=
>Hi,</div><div><br></div><div>If you can reproduce it, use one of the debug=
ging option to find out access to which file triggers it:</div><div><a href=
=3D"https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing">=
https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing</a></=
div><div><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0p=
x 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><=
font size=3D"2" face=3D"Courier 10 Pitch">
      <br>
      many thanks, L.<br>
    </font>
  </div>

_______________________________________________<br>
selinux mailing list -- <a href=3D"mailto:[email protected]" =
target=3D"_blank">[email protected]</a><br>
To unsubscribe send an email to <a href=3D"mailto:[email protected]=
aproject.org" target=3D"_blank">[email protected]</a><b=
r>
Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro=
ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe=
doraproject.org/en-US/project/code-of-conduct/</a><br>
List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui=
delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik=
i/Mailing_list_guidelines</a><br>
List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel=
[email protected]" rel=3D"noreferrer" target=3D"_blank">https://=
lists.fedoraproject.org/archives/list/[email protected]</a><b=
r>
Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras=
tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/=
fedora-infrastructure/new_issue</a><br>
</blockquote></div><br clear=3D"all"><br><span class=3D"gmail_signature_pre=
fix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"l=
tr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div>=
<div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><br>
Zdenek Pytela</div><div dir=3D"ltr">Security SELinux team</div></div></div>=
</div></div></div></div></div></div></div></div></div></div></div></div>

--0000000000000503b80609301717--

--===============0602304151039066974==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc2VsaW51eCBt
YWlsaW5nIGxpc3QgLS0gc2VsaW51eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpUbyB1bnN1YnNj
cmliZSBzZW5kIGFuIGVtYWlsIHRvIHNlbGludXgtbGVhdmVAbGlzdHMuZmVkb3JhcHJvamVjdC5v
cmcKRmVkb3JhIENvZGUgb2YgQ29uZHVjdDogaHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qub3Jn
L2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LwpMaXN0IEd1aWRlbGluZXM6IGh0dHBzOi8v
ZmVkb3JhcHJvamVjdC5vcmcvd2lraS9NYWlsaW5nX2xpc3RfZ3VpZGVsaW5lcwpMaXN0IEFyY2hp
dmVzOiBodHRwczovL2xpc3RzLmZlZG9yYXByb2plY3Qub3JnL2FyY2hpdmVzL2xpc3Qvc2VsaW51
eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpEbyBub3QgcmVwbHkgdG8gc3BhbSwgcmVwb3J0IGl0
OiBodHRwczovL3BhZ3VyZS5pby9mZWRvcmEtaW5mcmFzdHJ1Y3R1cmUvbmV3X2lzc3VlCg==

--===============0602304151039066974==--