Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Russell Coker <russell@coker.com.au>
To:     selinux-refpolicy@vger.kernel.org,
        Chris PeBenito <pebenito@ieee.org>
Reply-To: russell@coker.com.au
Subject: Re: [PATCH] mailman3 V2.1
Date:   Wed, 09 Mar 2022 15:53:57 +1100
Message-ID: <1846899.oGztph3vmi@xev>
In-Reply-To: <e4934027-8b31-3218-e9f1-5e9c5aacbda1@ieee.org>
References: <YhDHwUUJcxfw9+sP@xev.coker.com.au> <e4934027-8b31-3218-e9f1-5e9c5aacbda1@ieee.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Precedence: bulk

On Tuesday, 1 March 2022 08:01:02 AEDT Chris PeBenito wrote:
> > +# need SELinuxContext=system_u:system_r:mailman_cgi_t:s0 in the systemd
> > +# service file for the correct context on running /usr/bin/uwsgi for
> > +# mailman3-web
> > +corecmd_bin_entry_type(mailman_cgi_t)
> 
> Why can't the label be changed for uwsgi?

Because uwsgi is a service program that may be used by many daemons.

> >   allow mailman_mail_t self:capability { dac_override kill setgid setuid
> >   sys_tty_config };> 
> > -allow mailman_mail_t self:process { signal signull setsched };
> > +allow mailman_mail_t self:process { execmem signal signull setsched };
> 
> Any idea why the execmem is hit?

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=913544

Mailman is mostly Python and function pointers in Python needs execmem, this 
is used by the openssl Python library among other things.

> > Index: refpolicy-2.20220219/policy/modules/system/systemd.te
> > ===================================================================
> > --- refpolicy-2.20220219.orig/policy/modules/system/systemd.te
> > +++ refpolicy-2.20220219/policy/modules/system/systemd.te
> > @@ -1796,6 +1796,10 @@ optional_policy(`
> > 
> >   ')
> >   
> >   optional_policy(`
> > 
> > +	mailman_manage_lockdir(systemd_tmpfiles_t)
> 
> There should be a systemd_tmpfilesd_managed(mailman_lock_t) in mailman.te
> instead.

OK, I'll make a new version with that change.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/