Re: [PATCH] Revert "dns-hatchet: apply resolv.conf's selinux context to new resolv.conf"

Sorry about the delay, the message ended up in spam and I only found it 
today.

On 6/12/26 7:04 PM, Jason A. Donenfeld wrote:
> On Mon, Jun 08, 2026 at 03:36:10PM +0200, Robert Frohl wrote:
>> This reverts commit 2ce4680bd34f371aacd3c09673c3c907274321cd.
>>
>> selinux does not allow every domain to set file contexts and will raise
>> relabelto/relabelfrom AVCs and block these changes if a domain tries to update
>> the selinux context.
>>
>> It is better to ignore selinux and leave the proper labeling to the
>> selinux policy, which can add proper file transitions for the right
>> context.
> 
> Does any existent selinux policy have anything to handle this? Or is this
> purely speculative/future-facing?

The Fedora selinux policy (which is also the openSUSE upstream) does not 
have anything to handle the DNS hatchet [0]. I did also check the 
refpolicy. There a slightly different wireguard implementation exists 
[1], but the dns-hatchet is not yet covered.
Beyond that I am not sure who else is maintaining a selinux policy and 
may have implemented a solution for wireguard. I briefly checked 
android's sepolicy and I could not find anything regarding wireguard.

More generically I do not think that the manual relabeling in 
hatchet.bash could have ever worked without a change in the respective 
selinux policies, because a process labeling files would need to have 
special privileges to do so. Which would mean in practice that it needs 
specific allow rules in the policy for changing the labels.
At the same time a file transition could automatically assign the 
correct context to the new 'resolv.conf' and would be more concise, as 
it only needs one rule.
Meaning for both the SELinux policy needs to be adjusted.

> 
> Also, wondering if any distros are still shipping the hatchet.


We are shipping a slightly modified version with oS TW [2] and I just 
learned that Fedora disabled the hatchet with Fedora 33 [3].

In that case I would switch my approach to have the DNS hatchet policy 
addition only in our downstream SELinux policy, as it might also explain 
why Fedora was not to keen to have the policy change.


[0] 
https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/wireguard.te
[1] 
https://github.com/SELinuxProject/refpolicy/blob/main/policy/modules/services/wireguard.te
[2] 
https://build.opensuse.org/package/show/network:vpn:wireguard/wireguard-tools
[3] 
https://src.fedoraproject.org/rpms/wireguard-tools/blob/rawhide/f/wireguard-tools.spec#_33

-- 
SELinux Security Engineer, SUSE Software Solutions Germany GmbH, 
Frankenstraße 146, 90461 Nürnberg, Germany, GF: Jochen Jaser, Andrew 
McDonald, Werner Knoblich
GPG: D29F 82AA 9FD5 9D6E 74B1  6370 089E DB3D 230A 2404