Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Russell Coker <russell@coker.com.au>
To:     selinux-refpolicy@vger.kernel.org,
        Chris PeBenito <pebenito@ieee.org>
Reply-To: russell@coker.com.au
Subject: Re: [PATCH] certbot V2
Date:   Tue, 15 Mar 2022 00:56:13 +1100
Message-ID: <2933855.8EzMN8LN0u@xev>
In-Reply-To: <736887c7-d588-8562-4933-030947915fe2@ieee.org>
References: <Yig49Vvl4h+Nz/A0@xev.coker.com.au> <736887c7-d588-8562-4933-030947915fe2@ieee.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Precedence: bulk

On Tuesday, 15 March 2022 00:53:14 AEDT Chris PeBenito wrote:
> > -logging_search_logs(certbot_t)
> > +logging_log_filetrans(certbot_t, certbot_log_t, dir, "letsencrypt")
> 
> I don't see any conflicting type_transitions here or above.  If there are
> none, then the letsencrypt should be removed.

Do we want to allow it to create whatever directories it likes under /var/log?  
What if it decides to create something else inappropriately?

There aren't any conflicts, just an issue of whether we want to allow it 
unrestricted write access to an important directory.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/