Just upgraded to Fedora 43 on a server

This is a multi-part message in MIME format.

--===============7485390578038508779==
Content-Type: multipart/alternative; boundary="nextPart2724058.vYhyI6sBWr"
Content-Transfer-Encoding: 7Bit

This is a multi-part message in MIME format.

--nextPart2724058.vYhyI6sBWr
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="utf-8"

With SELinux in enforcing mode on a remote server, writing policy files, I am using 
commands like "ausearch -ts recent" and "semodule -i local_policy.cil".
The file has a "lisp" syntax I can't really find documented anywhere, and this is a hammer-
and-nails approach for a lot of stuff on the "targeted" policy that probably should be 
allowed but is not or was not allowed by default. Of course, you really do not want any of 
this stuff unless there's a specific reason you do want it.

Failure is not an option, and there is not really a good way to recover if anything goes 
wrong.

I had previously followed a lot of tutorials to enable SELinux on Fedora 41, and the 
upgrade proceeded without incident except that dovecot and postfix failed to read the SSL 
certificates and keys because of AVC denials, and the configuration files for dovecot had 
totally changed in format.

local_policy.cil:
    (allow postfix_smtpd_t var_lib_t (file (getattr open read))) 
    (allow httpd_t unconfined_service_t (unix_stream_socket (connectto))) 
    (allow init_t mysqld_port_t (tcp_socket (name_connect))) 
    (allow init_t soundd_port_t (tcp_socket (name_connect))) 
    (allow init_t http_port_t (tcp_socket (name_connect))) 
    (allow init_t user_home_t (file (getattr open read write append create
        rename execute execute_no_trans lock))) 
    (allow init_t user_home_t (dir (getattr search))) 
    (allow init_t user_home_t (lnk_file (read))) 
    (allow postfix_smtpd_t postfix_data_t (file (getattr open read write
        append create rename execute execute_no_trans lock))) 
    (allow postfix_smtpd_t postfix_data_t (dir (getattr search))) 
    (allow postfix_smtpd_t postfix_data_t (lnk_file (read))) 
    (allow init_t io_uring_t (anon_inode (create map read write)))  
    (allow init_t self (process (execmem))) 
    (allow saslauthd_t saslauthd_t (capability (dac_read_search))) 
    (allow saslauthd_t saslauthd_t (file (getattr read))) 
    (allow saslauthd_t saslauthd_t (dir (getattr search))) 
    (allow saslauthd_t saslauthd_t (lnk_file (read)))


--nextPart2724058.vYhyI6sBWr
Content-Transfer-Encoding: base64
Content-Type: text/html; charset="utf-8"

PGh0bWw+CjxoZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJjb250ZW50LXR5cGUiIGNvbnRlbnQ9InRl
eHQvaHRtbDsgY2hhcnNldD1VVEYtOCI+CjwvaGVhZD4KPGJvZHk+PHAgc3R5bGU9Im1hcmdpbi10
b3A6MDttYXJnaW4tYm90dG9tOjA7bWFyZ2luLWxlZnQ6MDttYXJnaW4tcmlnaHQ6MDsiPldpdGgg
U0VMaW51eCBpbiBlbmZvcmNpbmcgbW9kZSBvbiBhIHJlbW90ZSBzZXJ2ZXIsIHdyaXRpbmcgcG9s
aWN5IGZpbGVzLCBJIGFtIHVzaW5nIGNvbW1hbmRzIGxpa2UgJnF1b3Q7YXVzZWFyY2ggLXRzIHJl
Y2VudCZxdW90OyBhbmQgJnF1b3Q7c2Vtb2R1bGUgLWkgbG9jYWxfcG9saWN5LmNpbCZxdW90Oy48
L3A+CjxwIHN0eWxlPSJtYXJnaW4tdG9wOjA7bWFyZ2luLWJvdHRvbTowO21hcmdpbi1sZWZ0OjA7
bWFyZ2luLXJpZ2h0OjA7Ij5UaGUgZmlsZSBoYXMgYSAmcXVvdDtsaXNwJnF1b3Q7IHN5bnRheCBJ
IGNhbid0IHJlYWxseSBmaW5kIGRvY3VtZW50ZWQgYW55d2hlcmUsIGFuZCB0aGlzIGlzIGEgaGFt
bWVyLWFuZC1uYWlscyBhcHByb2FjaCBmb3IgYSBsb3Qgb2Ygc3R1ZmYgb24gdGhlICZxdW90O3Rh
cmdldGVkJnF1b3Q7IHBvbGljeSB0aGF0IHByb2JhYmx5IHNob3VsZCBiZSBhbGxvd2VkIGJ1dCBp
cyBub3Qgb3Igd2FzIG5vdCBhbGxvd2VkIGJ5IGRlZmF1bHQuIE9mIGNvdXJzZSwgeW91IHJlYWxs
eSBkbyBub3Qgd2FudCBhbnkgb2YgdGhpcyBzdHVmZiB1bmxlc3MgdGhlcmUncyBhIHNwZWNpZmlj
IHJlYXNvbiB5b3UgZG8gd2FudCBpdC48L3A+CjxiciAvPjxwIHN0eWxlPSJtYXJnaW4tdG9wOjA7
bWFyZ2luLWJvdHRvbTowO21hcmdpbi1sZWZ0OjA7bWFyZ2luLXJpZ2h0OjA7Ij5GYWlsdXJlIGlz
IG5vdCBhbiBvcHRpb24sIGFuZCB0aGVyZSBpcyBub3QgcmVhbGx5IGEgZ29vZCB3YXkgdG8gcmVj
b3ZlciBpZiBhbnl0aGluZyBnb2VzIHdyb25nLjwvcD4KPGJyIC8+PHAgc3R5bGU9Im1hcmdpbi10
b3A6MDttYXJnaW4tYm90dG9tOjA7bWFyZ2luLWxlZnQ6MDttYXJnaW4tcmlnaHQ6MDsiPkkgaGFk
IHByZXZpb3VzbHkgZm9sbG93ZWQgYSBsb3Qgb2YgdHV0b3JpYWxzIHRvIGVuYWJsZSBTRUxpbnV4
IG9uIEZlZG9yYSA0MSwgYW5kIHRoZSB1cGdyYWRlIHByb2NlZWRlZCB3aXRob3V0IGluY2lkZW50
IGV4Y2VwdCB0aGF0IGRvdmVjb3QgYW5kIHBvc3RmaXggZmFpbGVkIHRvIHJlYWQgdGhlIFNTTCBj
ZXJ0aWZpY2F0ZXMgYW5kIGtleXMgYmVjYXVzZSBvZiBBVkMgZGVuaWFscywgYW5kIHRoZSBjb25m
aWd1cmF0aW9uIGZpbGVzIGZvciBkb3ZlY290IGhhZCB0b3RhbGx5IGNoYW5nZWQgaW4gZm9ybWF0
LjwvcD4KPGJyIC8+PHAgc3R5bGU9Im1hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjA7bWFyZ2lu
LWxlZnQ6MDttYXJnaW4tcmlnaHQ6MDsiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTptb25vc3Bh
Y2U7Ij5sb2NhbF9wb2xpY3kuY2lsOjxiciAvPiZuYnNwOyZuYnNwOyZuYnNwOyA8c3BhbiBzdHls
ZT0iY29sb3I6IzAwMDAwMDsiPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiNmZmZmZmY7
Ij4oYWxsb3cgcG9zdGZpeF9zbXRwZF90IHZhcl9saWJfdCAoZmlsZSAoZ2V0YXR0ciBvcGVuIHJl
YWQpKSkgPC9zcGFuPjwvc3Bhbj48YnIgLz4mbmJzcDsmbmJzcDsmbmJzcDsgPHNwYW4gc3R5bGU9
ImNvbG9yOiMwMDAwMDA7Ij48c3BhbiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojZmZmZmZmOyI+
KGFsbG93IGh0dHBkX3QgdW5jb25maW5lZF9zZXJ2aWNlX3QgKHVuaXhfc3RyZWFtX3NvY2tldCAo
Y29ubmVjdHRvKSkpIDwvc3Bhbj48L3NwYW4+PGJyIC8+Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxzcGFu
IHN0eWxlPSJjb2xvcjojMDAwMDAwOyI+PHNwYW4gc3R5bGU9ImJhY2tncm91bmQtY29sb3I6I2Zm
ZmZmZjsiPihhbGxvdyBpbml0X3QgbXlzcWxkX3BvcnRfdCAodGNwX3NvY2tldCAobmFtZV9jb25u
ZWN0KSkpIDwvc3Bhbj48L3NwYW4+PGJyIC8+Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxzcGFuIHN0eWxl
PSJjb2xvcjojMDAwMDAwOyI+PHNwYW4gc3R5bGU9ImJhY2tncm91bmQtY29sb3I6I2ZmZmZmZjsi
PihhbGxvdyBpbml0X3Qgc291bmRkX3BvcnRfdCAodGNwX3NvY2tldCAobmFtZV9jb25uZWN0KSkp
IDwvc3Bhbj48L3NwYW4+PGJyIC8+Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxzcGFuIHN0eWxlPSJjb2xv
cjojMDAwMDAwOyI+PHNwYW4gc3R5bGU9ImJhY2tncm91bmQtY29sb3I6I2ZmZmZmZjsiPihhbGxv
dyBpbml0X3QgaHR0cF9wb3J0X3QgKHRjcF9zb2NrZXQgKG5hbWVfY29ubmVjdCkpKSA8L3NwYW4+
PC9zcGFuPjxiciAvPiZuYnNwOyZuYnNwOyZuYnNwOyA8c3BhbiBzdHlsZT0iY29sb3I6IzAwMDAw
MDsiPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiNmZmZmZmY7Ij4oYWxsb3cgaW5pdF90
IHVzZXJfaG9tZV90IChmaWxlIChnZXRhdHRyIG9wZW4gcmVhZCB3cml0ZSBhcHBlbmQgY3JlYXRl
PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9wPgo8cCBzdHlsZT0ibWFyZ2luLXRvcDowO21hcmdpbi1i
b3R0b206MDttYXJnaW4tbGVmdDowO21hcmdpbi1yaWdodDowOyI+PHNwYW4gc3R5bGU9ImNvbG9y
OiMwMDAwMDA7Ij48c3BhbiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojZmZmZmZmOyI+Jm5ic3A7
Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHJlbmFtZSBleGVjdXRlIGV4ZWN1
dGVfbm9fdHJhbnMgbG9jaykpKSA8L3NwYW4+PC9zcGFuPjxiciAvPiZuYnNwOyZuYnNwOyZuYnNw
OyA8c3BhbiBzdHlsZT0iY29sb3I6IzAwMDAwMDsiPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNv
bG9yOiNmZmZmZmY7Ij4oYWxsb3cgaW5pdF90IHVzZXJfaG9tZV90IChkaXIgKGdldGF0dHIgc2Vh
cmNoKSkpIDwvc3Bhbj48L3NwYW4+PGJyIC8+Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxzcGFuIHN0eWxl
PSJjb2xvcjojMDAwMDAwOyI+PHNwYW4gc3R5bGU9ImJhY2tncm91bmQtY29sb3I6I2ZmZmZmZjsi
PihhbGxvdyBpbml0X3QgdXNlcl9ob21lX3QgKGxua19maWxlIChyZWFkKSkpIDwvc3Bhbj48L3Nw
YW4+PGJyIC8+Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxzcGFuIHN0eWxlPSJjb2xvcjojMDAwMDAwOyI+
PHNwYW4gc3R5bGU9ImJhY2tncm91bmQtY29sb3I6I2ZmZmZmZjsiPihhbGxvdyBwb3N0Zml4X3Nt
dHBkX3QgcG9zdGZpeF9kYXRhX3QgKGZpbGUgKGdldGF0dHIgb3BlbiByZWFkIHdyaXRlPC9zcGFu
Pjwvc3Bhbj48L3A+CjxwIHN0eWxlPSJtYXJnaW4tdG9wOjA7bWFyZ2luLWJvdHRvbTowO21hcmdp
bi1sZWZ0OjA7bWFyZ2luLXJpZ2h0OjA7Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMDAwMDsiPjxz
cGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiNmZmZmZmY7Ij4mbmJzcDsmbmJzcDsmbmJzcDsm
bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgYXBwZW5kIGNyZWF0ZSByZW5hbWUgZXhlY3V0ZSBleGVj
dXRlX25vX3RyYW5zIGxvY2spKSkgPC9zcGFuPjwvc3Bhbj48YnIgLz4mbmJzcDsmbmJzcDsmbmJz
cDsgPHNwYW4gc3R5bGU9ImNvbG9yOiMwMDAwMDA7Ij48c3BhbiBzdHlsZT0iYmFja2dyb3VuZC1j
b2xvcjojZmZmZmZmOyI+KGFsbG93IHBvc3RmaXhfc210cGRfdCBwb3N0Zml4X2RhdGFfdCAoZGly
IChnZXRhdHRyIHNlYXJjaCkpKSA8L3NwYW4+PC9zcGFuPjxiciAvPiZuYnNwOyZuYnNwOyZuYnNw
OyA8c3BhbiBzdHlsZT0iY29sb3I6IzAwMDAwMDsiPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNv
bG9yOiNmZmZmZmY7Ij4oYWxsb3cgcG9zdGZpeF9zbXRwZF90IHBvc3RmaXhfZGF0YV90IChsbmtf
ZmlsZSAocmVhZCkpKSA8L3NwYW4+PC9zcGFuPjxiciAvPiZuYnNwOyZuYnNwOyZuYnNwOyA8c3Bh
biBzdHlsZT0iY29sb3I6IzAwMDAwMDsiPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiNm
ZmZmZmY7Ij4oYWxsb3cgaW5pdF90IGlvX3VyaW5nX3QgKGFub25faW5vZGUgKGNyZWF0ZSBtYXAg
cmVhZCB3cml0ZSkpKSDCoDwvc3Bhbj48L3NwYW4+PGJyIC8+Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxz
cGFuIHN0eWxlPSJjb2xvcjojMDAwMDAwOyI+PHNwYW4gc3R5bGU9ImJhY2tncm91bmQtY29sb3I6
I2ZmZmZmZjsiPihhbGxvdyBpbml0X3Qgc2VsZiAocHJvY2VzcyAoZXhlY21lbSkpKSA8L3NwYW4+
PC9zcGFuPjxiciAvPiZuYnNwOyZuYnNwOyZuYnNwOyA8c3BhbiBzdHlsZT0iY29sb3I6IzAwMDAw
MDsiPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiNmZmZmZmY7Ij4oYWxsb3cgc2FzbGF1
dGhkX3Qgc2FzbGF1dGhkX3QgKGNhcGFiaWxpdHkgKGRhY19yZWFkX3NlYXJjaCkpKSA8L3NwYW4+
PC9zcGFuPjxiciAvPiZuYnNwOyZuYnNwOyZuYnNwOyA8c3BhbiBzdHlsZT0iY29sb3I6IzAwMDAw
MDsiPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiNmZmZmZmY7Ij4oYWxsb3cgc2FzbGF1
dGhkX3Qgc2FzbGF1dGhkX3QgKGZpbGUgKGdldGF0dHIgcmVhZCkpKSA8L3NwYW4+PC9zcGFuPjxi
ciAvPiZuYnNwOyZuYnNwOyZuYnNwOyA8c3BhbiBzdHlsZT0iY29sb3I6IzAwMDAwMDsiPjxzcGFu
IHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiNmZmZmZmY7Ij4oYWxsb3cgc2FzbGF1dGhkX3Qgc2Fz
bGF1dGhkX3QgKGRpciAoZ2V0YXR0ciBzZWFyY2gpKSkgPC9zcGFuPjwvc3Bhbj48YnIgLz4mbmJz
cDsmbmJzcDsmbmJzcDsgPHNwYW4gc3R5bGU9ImNvbG9yOiMwMDAwMDA7Ij48c3BhbiBzdHlsZT0i
YmFja2dyb3VuZC1jb2xvcjojZmZmZmZmOyI+KGFsbG93IHNhc2xhdXRoZF90IHNhc2xhdXRoZF90
IChsbmtfZmlsZSAocmVhZCkpKTwvc3Bhbj48L3NwYW4+PGJyIC8+PC9wPgo8L2JvZHk+CjwvaHRt
bD4=


--nextPart2724058.vYhyI6sBWr--




--===============7485390578038508779==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu
dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z
dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl
Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0
Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw
czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB
cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl
bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y
dCBpdDogaHR0cHM6Ly9mb3JnZS5mZWRvcmFwcm9qZWN0Lm9yZy9pbmZyYS90aWNrZXRzL2lzc3Vl
cy9uZXcK

--===============7485390578038508779==--