Re: Just upgraded to Fedora 43 on a server
"Mark E. via selinux" <[email protected]> Tue, 24 Mar 2026 13:34:56 -0400
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============4733447502821946210==
Content-Type: multipart/alternative;
boundary="------------5uJFq7WOIX3R20UErS0ElVFq"
Content-Language: en-US
This is a multi-part message in MIME format.
--------------5uJFq7WOIX3R20UErS0ElVFq
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
I have dovecot and postfix running on an F42 server and did have to do a
bit to get at least dovecot reading the certs. I never work with .cil
stuff though, I think this is generally considered more arcane and
awkward than the .sel -> .mod-> .pp route.
Can't say whether this will work on F43 since you did not post actual
ausearch/AVC errors (probably you should lead with those):
module dovecot_read_cert 1.0;
require {
class lnk_file { read };
type init_t, dovecot_cert_t;
}
allow init_t dovecot_cert_t:lnk_file read;
Save that as dovecot_read_cert.sel and:
checkmodule -m -o dovecot_read_cert.mod dovecot_read_cert.sel
semodule_package -o dovecot_read_cert.pp -m dovecot_read_cert.mod
semodule -i dovecot_read_cert.pp
You can then delete the .pp and .mod files. Pretty sure I got most of
the syntax etc. from "SELinux System Administration" by Sven Vermeulen,
if you want a book recommendation, although I think there are quicker
ways of doing this now, eg. `ausearch -m avc -t recent | audit2allow`
will generate .sel syntax you can cherry pick into a module as above
(but you have to intuit the `require {}` section).
Again, posting the raw audit/ausearch output is probably the fastest way
to get help.
On 2026-03-23 16:17, justina colmena ~biz via selinux wrote:
>
> With SELinux in enforcing mode on a remote server, writing policy
> files, I am using commands like "ausearch -ts recent" and "semodule -i
> local_policy.cil".
>
> The file has a "lisp" syntax I can't really find documented anywhere,
> and this is a hammer-and-nails approach for a lot of stuff on the
> "targeted" policy that probably should be allowed but is not or was
> not allowed by default. Of course, you really do not want any of this
> stuff unless there's a specific reason you do want it.
>
>
> Failure is not an option, and there is not really a good way to
> recover if anything goes wrong.
>
>
> I had previously followed a lot of tutorials to enable SELinux on
> Fedora 41, and the upgrade proceeded without incident except that
> dovecot and postfix failed to read the SSL certificates and keys
> because of AVC denials, and the configuration files for dovecot had
> totally changed in format.
>
>
> local_policy.cil:
> (allow postfix_smtpd_t var_lib_t (file (getattr open read)))
> (allow httpd_t unconfined_service_t (unix_stream_socket (connectto)))
> (allow init_t mysqld_port_t (tcp_socket (name_connect)))
> (allow init_t soundd_port_t (tcp_socket (name_connect)))
> (allow init_t http_port_t (tcp_socket (name_connect)))
> (allow init_t user_home_t (file (getattr open read write append create
>
> rename execute execute_no_trans lock)))
> (allow init_t user_home_t (dir (getattr search)))
> (allow init_t user_home_t (lnk_file (read)))
> (allow postfix_smtpd_t postfix_data_t (file (getattr open read write
>
> append create rename execute execute_no_trans lock)))
> (allow postfix_smtpd_t postfix_data_t (dir (getattr search)))
> (allow postfix_smtpd_t postfix_data_t (lnk_file (read)))
> (allow init_t io_uring_t (anon_inode (create map read write)))
> (allow init_t self (process (execmem)))
> (allow saslauthd_t saslauthd_t (capability (dac_read_search)))
> (allow saslauthd_t saslauthd_t (file (getattr read)))
> (allow saslauthd_t saslauthd_t (dir (getattr search)))
> (allow saslauthd_t saslauthd_t (lnk_file (read)))
>
>
--------------5uJFq7WOIX3R20UErS0ElVFq
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>I have dovecot and postfix running on an F42 server and did have
to do a bit to get at least dovecot reading the certs. I never
work with .cil stuff though, I think this is generally considered
more arcane and awkward than the .sel -> .mod-> .pp route.</p>
<p>Can't say whether this will work on F43 since you did not post
actual ausearch/AVC errors (probably you should lead with those):</p>
<p><br>
</p>
<p><font face="monospace">module dovecot_read_cert 1.0;<br>
require {<br>
class lnk_file { read };<br>
type init_t, dovecot_cert_t;<br>
}<br>
allow init_t dovecot_cert_t:lnk_file read;</font></p>
<p><br>
</p>
<p>Save that as dovecot_read_cert.sel and:</p>
<p><font face="monospace">checkmodule -m -o dovecot_read_cert.mod
dovecot_read_cert.sel</font></p>
<p><font face="monospace">semodule_package -o dovecot_read_cert.pp
-m dovecot_read_cert.mod</font></p>
<p><font face="monospace">semodule -i dovecot_read_cert.pp</font></p>
<p><br>
</p>
<p>You can then delete the .pp and .mod files. Pretty sure I got
most of the syntax etc. from "SELinux System Administration" by
Sven Vermeulen, if you want a book recommendation, although I
think there are quicker ways of doing this now, eg. `ausearch -m
avc -t recent | audit2allow` will generate .sel syntax you can
cherry pick into a module as above (but you have to intuit the
`require {}` section).</p>
<p><br>
</p>
<p>Again, posting the raw audit/ausearch output is probably the
fastest way to get help.</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 2026-03-23 16:17, justina colmena
~biz via selinux wrote:<br>
</div>
<blockquote type="cite" cite="mid:2732431.fDdHjke4Dd@fedora">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<p
style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">With
SELinux in enforcing mode on a remote server, writing policy
files, I am using commands like "ausearch -ts recent" and
"semodule -i local_policy.cil".</p>
<p
style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">The
file has a "lisp" syntax I can't really find documented
anywhere, and this is a hammer-and-nails approach for a lot of
stuff on the "targeted" policy that probably should be allowed
but is not or was not allowed by default. Of course, you really
do not want any of this stuff unless there's a specific reason
you do want it.</p>
<br>
<p
style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">Failure
is not an option, and there is not really a good way to recover
if anything goes wrong.</p>
<br>
<p
style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;">I had
previously followed a lot of tutorials to enable SELinux on
Fedora 41, and the upgrade proceeded without incident except
that dovecot and postfix failed to read the SSL certificates and
keys because of AVC denials, and the configuration files for
dovecot had totally changed in format.</p>
<br>
<p
style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span
style="font-family:monospace;">local_policy.cil:<br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow postfix_smtpd_t
var_lib_t (file (getattr open read))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow httpd_t
unconfined_service_t (unix_stream_socket (connectto))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow init_t
mysqld_port_t (tcp_socket (name_connect))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow init_t
soundd_port_t (tcp_socket (name_connect))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow init_t
http_port_t (tcp_socket (name_connect))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow init_t
user_home_t (file (getattr open read write append create</span></span></span></p>
<p
style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span
style="color:#000000;"><span style="background-color:#ffffff;">
rename execute execute_no_trans lock))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow init_t user_home_t
(dir (getattr search))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow init_t user_home_t
(lnk_file (read))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow postfix_smtpd_t
postfix_data_t (file (getattr open read write</span></span></p>
<p
style="margin-top:0;margin-bottom:0;margin-left:0;margin-right:0;"><span
style="color:#000000;"><span style="background-color:#ffffff;">
append create rename execute execute_no_trans lock))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow postfix_smtpd_t
postfix_data_t (dir (getattr search))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow postfix_smtpd_t
postfix_data_t (lnk_file (read))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow init_t io_uring_t
(anon_inode (create map read write))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow init_t self
(process (execmem))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow saslauthd_t
saslauthd_t (capability (dac_read_search))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow saslauthd_t
saslauthd_t (file (getattr read))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow saslauthd_t
saslauthd_t (dir (getattr search))) </span></span><br>
<span style="color:#000000;"><span
style="background-color:#ffffff;">(allow saslauthd_t
saslauthd_t (lnk_file (read)))</span></span><br>
</p>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
</body>
</html>
--------------5uJFq7WOIX3R20UErS0ElVFq--
--===============4733447502821946210==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu
dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z
dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl
Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0
Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw
czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB
cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl
bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y
dCBpdDogaHR0cHM6Ly9mb3JnZS5mZWRvcmFwcm9qZWN0Lm9yZy9pbmZyYS90aWNrZXRzL2lzc3Vl
cy9uZXcK
--===============4733447502821946210==--