• Recent
  • Unsolved
  • Tags
  • Popular
  • Users
  • Groups
  • Search
  • Register
  • Login
  • Recent
  • Unsolved
  • Tags
  • Popular
  • Users
  • Groups
  • Search
  • Register
  • Login

SELinux Policy

Scheduled Pinned Locked Moved
General
3
19
17.6k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    Joe Schmitt Senior Developer
    last edited by Joe Schmitt Nov 17, 2015, 8:52 PM Nov 17, 2015, 1:01 AM

    Below are instructions to test my SELinux policy for FOG. This should allow your server to operate while SELinux is still enabled. If you encounter any issues while using the policy, please state exactly what you were doing when you encountered the issue.

    To get the files you need, update your fogproject trunk (git pull or svn up).

    Installation

    yum install -y selinux-policy-devel gcc make
    cd ../fogproject/SELinux
    make -f /usr/share/selinux/devel/Makefile fog.pp
    semodule -i fog.pp
    

    Removal

    semodule -r fog
    

    Troubleshooting

    If you get an error like the one below

    make: /usr/share/selinux/devel/Makefile: No such file or directory
    make: *** No rule to make target `/usr/share/selinux/devel/Makefile'.  Stop.
    

    You should:

    1. Ensure you installed SELinux development tools
    2. Locate your SELinux Makefile. The installation command will look for it under /usr/share/selinux.

    Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

    1 Reply Last reply Reply Quote 2
    • W
      Wayne Workman
      last edited by Wayne Workman Nov 16, 2015, 8:22 PM Nov 17, 2015, 2:21 AM

      Compiled for me.
      https://drive.google.com/file/d/0B2BmriqzYEgXeG81aHRreWtMTXc/view?usp=sharing

      Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
      Daily Clean Installation Results:
      https://fogtesting.fogproject.us/
      FOG Reporting:
      https://fog-external-reporting-results.fogproject.us/

      1 Reply Last reply Reply Quote 0
      • W
        Wayne Workman
        last edited by Nov 18, 2015, 1:36 AM

        #wiki Hashtagging this for addition to the wiki.

        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
        Daily Clean Installation Results:
        https://fogtesting.fogproject.us/
        FOG Reporting:
        https://fog-external-reporting-results.fogproject.us/

        1 Reply Last reply Reply Quote 0
        • W
          Wayne Workman
          last edited by Nov 18, 2015, 2:41 AM

          I had to find my Makefile on Fedora 21 server. It’s funny because it just worked on Fedora 23 server, literally copy/paste.

          find / | grep Makefile | grep -i selinux

          /usr/share/selinux/devel/include/Makefile
          /usr/share/selinux/devel/Makefile    #  <--- that's the one.
          

          make -f /usr/share/selinux/devel/Makefile fog.pp

          Compiling targeted fog module
          /usr/bin/checkmodule:  loading policy configuration from tmp/fog.tmp
          /usr/bin/checkmodule:  policy configuration loaded
          /usr/bin/checkmodule:  writing binary representation (version 17) to tmp/fog.mod
          Creating targeted fog.pp policy package
          rm tmp/fog.mod tmp/fog.mod.fc
          

          semodule -i fog.pp

          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
          Daily Clean Installation Results:
          https://fogtesting.fogproject.us/
          FOG Reporting:
          https://fog-external-reporting-results.fogproject.us/

          1 Reply Last reply Reply Quote 0
          • J
            Joe Schmitt Senior Developer
            last edited by Nov 18, 2015, 2:52 AM

            @Wayne-Workman said:

            /usr/share/selinux/devel/Makefile

            Updated main command to reflect this.

            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

            1 Reply Last reply Reply Quote 1
            • G
              george1421 Moderator
              last edited by Nov 19, 2015, 2:40 AM

              No luck compiling for me on Centos 6.7

              [root@centtest SELinux]# make -f /usr/share/selinux/devel/Makefile fog.pp
              Compiling targeted fog module
              /usr/bin/checkmodule:  loading policy configuration from tmp/fog.tmp
              fog.te":50:ERROR 'unknown class service used in rule' at token ';' on line 3260:
              allow unconfined_t init_t:service enable;
              #============= unconfined_t ==============
              /usr/bin/checkmodule:  error(s) encountered while parsing configuration
              make: *** [tmp/fog.mod] Error 1
              
              

              Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

              1 Reply Last reply Reply Quote 0
              • J
                Joe Schmitt Senior Developer
                last edited by Nov 19, 2015, 2:41 AM

                @george1421 Centos 6 appears to be missing some of the modules I require. I’ve been trying to hunt down the exact dependencies I’d need, or if need be, a new policy with different rules / modules.

                Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                G 1 Reply Last reply Nov 19, 2015, 2:45 AM Reply Quote 1
                • G
                  george1421 Moderator @Joe Schmitt
                  last edited by Nov 19, 2015, 2:45 AM

                  @Jbob said:

                  @george1421 Centos 6 appears to be missing some of the modules I require. I’ve been trying to hunt down the exact dependencies I’d need, or if need be, a new policy with different rules / modules.

                  That’s why we are going through this. 😄 No worries on my part. We’ll get them worked out.

                  Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

                  1 Reply Last reply Reply Quote 0
                  • W
                    Wayne Workman
                    last edited by Wayne Workman Nov 22, 2015, 10:27 PM Nov 22, 2015, 11:39 PM

                    This installed fine on Fedora 23.

                    the SELinux stuff works fine on Fedora 23 Server so far.

                    I’ve tried this setup on a virtualized Fedora 23 FOG server. I’ve imaged 2 computers so far with this setup. One of them, I tried out WOL just to confirm that still works - it does.

                    Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                    Daily Clean Installation Results:
                    https://fogtesting.fogproject.us/
                    FOG Reporting:
                    https://fog-external-reporting-results.fogproject.us/

                    1 Reply Last reply Reply Quote 0
                    • W
                      Wayne Workman
                      last edited by Nov 26, 2015, 4:09 AM

                      Holding off on adding this to the WiKi - It is my hopes that enough people will try this out that it can be added to Trunk by the @Developers and implimented in FOG 1.3.0. 🙂

                      Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                      Daily Clean Installation Results:
                      https://fogtesting.fogproject.us/
                      FOG Reporting:
                      https://fog-external-reporting-results.fogproject.us/

                      1 Reply Last reply Reply Quote 0
                      • W
                        Wayne Workman
                        last edited by Dec 1, 2015, 1:43 PM

                        @Jbob As far as I can tell, in Fedora 23 Server Minimal, The SELinux module breaks the FOG_FTP_IMAGE_SIZE feature.

                        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                        Daily Clean Installation Results:
                        https://fogtesting.fogproject.us/
                        FOG Reporting:
                        https://fog-external-reporting-results.fogproject.us/

                        1 Reply Last reply Reply Quote 0
                        • W
                          Wayne Workman
                          last edited by Dec 1, 2015, 1:47 PM

                          There’s also this issue. I’m just going to tag the link and description here.

                          * Restarting Apache2 for fog vhost............................Failed!
                          

                          https://forums.fogproject.org/topic/6251/fedora-23-svn-4455-restarting-apache2-for-fog-vhost-failed

                          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                          Daily Clean Installation Results:
                          https://fogtesting.fogproject.us/
                          FOG Reporting:
                          https://fog-external-reporting-results.fogproject.us/

                          1 Reply Last reply Reply Quote 0
                          • W
                            Wayne Workman
                            last edited by Dec 3, 2015, 4:42 AM

                            Another problem that needs addressed with the SELinux setup:
                            https://forums.fogproject.org/topic/6278/can-t-delete-images

                            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                            Daily Clean Installation Results:
                            https://fogtesting.fogproject.us/
                            FOG Reporting:
                            https://fog-external-reporting-results.fogproject.us/

                            1 Reply Last reply Reply Quote 0
                            • W
                              Wayne Workman
                              last edited by Dec 12, 2015, 3:58 AM

                              @Jbob I really want to see SELinux incorporated into fog. I know it’s finals time, and many a aspiring young adult is quite busy making a future for themselves. That’s fine. I just don’t want this swept under the rug.

                              I’ve noticed that no changes have been made to the SELinux stuff.

                              [root@fog-server trunk]# cd SELinux
                              [root@fog-server SELinux]# ls
                              fog.fc  fog.if  fog.pp  fog.te  tmp
                              [root@fog-server SELinux]# make -f /usr/share/selinux/devel/Makefile fog.pp
                              make: 'fog.pp' is up to date.
                              

                              That’s fine - but if anyone wants me to run some tests, I’m up for it.

                              Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                              Daily Clean Installation Results:
                              https://fogtesting.fogproject.us/
                              FOG Reporting:
                              https://fog-external-reporting-results.fogproject.us/

                              1 Reply Last reply Reply Quote 0
                              • W
                                Wayne Workman
                                last edited by Dec 13, 2015, 6:17 AM

                                Added a link to this thread here: https://wiki.fogproject.org/wiki/index.php/FOG_security#Other_issues

                                Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                                Daily Clean Installation Results:
                                https://fogtesting.fogproject.us/
                                FOG Reporting:
                                https://fog-external-reporting-results.fogproject.us/

                                1 Reply Last reply Reply Quote 0
                                • W
                                  Wayne Workman
                                  last edited by Jan 19, 2016, 5:28 AM

                                  @Developers Apologies for spamming this thread to death… but I’d like to see a fully functional SELinux policy for FOG 1.3.0 for at least the CentOS 7 platform. Has any progress been made with the below problems by anyone?

                                  Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                                  Daily Clean Installation Results:
                                  https://fogtesting.fogproject.us/
                                  FOG Reporting:
                                  https://fog-external-reporting-results.fogproject.us/

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    Wayne Workman
                                    last edited by Wayne Workman Jan 25, 2016, 9:22 PM Jan 26, 2016, 2:42 AM

                                    I’m learning about these:

                                    yum install setroubleshoot setroubleshoot-server -y

                                    Apparently those two packages will help you analyze and tune a SELinux policy for anything.

                                    Another amazing resource (just watched the whole thing):
                                    https://www.youtube.com/watch?v=MxjenQ31b70

                                    I feel a lot better about Security Enhanced Linux now (SELinux), and I’ll definitely be creating my own modules for it. Luckily for me I’ve run a production fog server in Permissive mode for a HOT minute now, so all the information I would need to create a module is already there. 🙂

                                    Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                                    Daily Clean Installation Results:
                                    https://fogtesting.fogproject.us/
                                    FOG Reporting:
                                    https://fog-external-reporting-results.fogproject.us/

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      Joe Schmitt Senior Developer
                                      last edited by Joe Schmitt Nov 5, 2019, 12:12 AM Jan 28, 2016, 6:25 PM

                                      @Wayne-Workman I’ll update the policy hopefully within the week.

                                      Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                                      1 Reply Last reply Reply Quote 1
                                      • W
                                        Wayne Workman
                                        last edited by Jun 11, 2016, 5:07 PM

                                        Bumping this - it would be so nice to have SELinux enabled as a standard configuration.

                                        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                                        Daily Clean Installation Results:
                                        https://fogtesting.fogproject.us/
                                        FOG Reporting:
                                        https://fog-external-reporting-results.fogproject.us/

                                        1 Reply Last reply Reply Quote 0
                                        • 1 / 1
                                        • First post
                                          Last post

                                        193

                                        Online

                                        12.0k

                                        Users

                                        17.3k

                                        Topics

                                        155.2k

                                        Posts
                                        Copyright © 2012-2024 FOG Project