Re: dac_override with Cobbler

lejeczek <[email protected]> Fri, 3 Nov 2023 09:02:07 +0100
Newsgroups	gmane.linux.redhat.fedora.selinux
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--===============8027103910275256282==
Content-Type: multipart/alternative;
 boundary="------------Pzridc0PR7jI54dSnzgF440w"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------Pzridc0PR7jI54dSnzgF440w
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable



On 02/11/2023 20:06, Zdenek Pytela wrote:
>
>
> On Thu, Nov 2, 2023 at 6:18=E2=80=AFPM lejeczek=20
> <[email protected]> wrote:
>
>     Hi guys.
>
>     I wonder if someone might have seen _cobbler_ trying
>     to claim this.
>     I've tried a few sebools but regardless SELinux denies
>     cobbler:
>
>     #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D cobblerd_t =3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
>     allow cobblerd_t self:capability dac_override;
>
>     and from what I gather _dac_override_ is pretty big
>     thing and I wonder if _cobbler_ should have it.
>
> Hi,
>
> If you can reproduce it, use one of the debugging option=20
> to find out access to which file triggers it:
> https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing
>

Meanwhile I failed a BZ - it's systemd unable to start=20
_cobblerd_=C2=A0 vanilla default config
--------------Pzridc0PR7jI54dSnzgF440w
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
  </head>
  <body>
    <br>
    <br>
    <div class=3D"moz-cite-prefix">On 02/11/2023 20:06, Zdenek Pytela
      wrote:<br>
    </div>
    <blockquote type=3D"cite"
cite=3D"mid:CAO4UijDsxCvhOwYtSPvxdXU-hEc_JF8=3DUeNtXT8AE=3DcFLRnPrA@mail.=
gmail.com">
      <meta http-equiv=3D"content-type" content=3D"text/html; charset=3DU=
TF-8">
      <div dir=3D"ltr">
        <div dir=3D"ltr"><br>
        </div>
        <br>
        <div class=3D"gmail_quote">
          <div dir=3D"ltr" class=3D"gmail_attr">On Thu, Nov 2, 2023 at
            6:18=E2=80=AFPM lejeczek &lt;<a href=3D"mailto:peljasz@yahoo.=
co.uk"
              moz-do-not-send=3D"true" class=3D"moz-txt-link-freetext">pe=
[email protected]</a>&gt;
            wrote:<br>
          </div>
          <blockquote class=3D"gmail_quote"
style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);=
padding-left:1ex">
            <div> <font size=3D"2" face=3D"Courier 10 Pitch">Hi guys.<br>
                <br>
                I wonder if someone might have seen _cobbler_ trying to
                claim this.<br>
                I've tried a few sebools but regardless SELinux denies
                cobbler:<br>
                <br>
                #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D cobblerd_t =3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
                allow cobblerd_t self:capability dac_override;<br>
                <br>
                and from what I gather _dac_override_ is pretty big
                thing and I wonder if _cobbler_ should have it.<br>
              </font></div>
          </blockquote>
          <div>Hi,</div>
          <div><br>
          </div>
          <div>If you can reproduce it, use one of the debugging option
            to find out access to which file triggers it:</div>
          <div><a
href=3D"https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_audi=
ting"
              moz-do-not-send=3D"true" class=3D"moz-txt-link-freetext">ht=
tps://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing</a></=
div>
          <br>
        </div>
      </div>
    </blockquote>
    <br>
    <font size=3D"2" face=3D"Courier 10 Pitch">Meanwhile I failed a BZ -
      it's systemd unable to start _cobblerd_=C2=A0 vanilla default confi=
g</font>
  </body>
</html>

--------------Pzridc0PR7jI54dSnzgF440w--

--===============8027103910275256282==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc2VsaW51eCBt
YWlsaW5nIGxpc3QgLS0gc2VsaW51eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpUbyB1bnN1YnNj
cmliZSBzZW5kIGFuIGVtYWlsIHRvIHNlbGludXgtbGVhdmVAbGlzdHMuZmVkb3JhcHJvamVjdC5v
cmcKRmVkb3JhIENvZGUgb2YgQ29uZHVjdDogaHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qub3Jn
L2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LwpMaXN0IEd1aWRlbGluZXM6IGh0dHBzOi8v
ZmVkb3JhcHJvamVjdC5vcmcvd2lraS9NYWlsaW5nX2xpc3RfZ3VpZGVsaW5lcwpMaXN0IEFyY2hp
dmVzOiBodHRwczovL2xpc3RzLmZlZG9yYXByb2plY3Qub3JnL2FyY2hpdmVzL2xpc3Qvc2VsaW51
eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpEbyBub3QgcmVwbHkgdG8gc3BhbSwgcmVwb3J0IGl0
OiBodHRwczovL3BhZ3VyZS5pby9mZWRvcmEtaW5mcmFzdHJ1Y3R1cmUvbmV3X2lzc3VlCg==

--===============8027103910275256282==--