SELinux policies for systemd-homed

Ask Fedora
, , ,
1

Hi.

I was looking for the solution to missing SELinux policies for systemd-homed in F37. There are community members who have created custom SELinux policies, but I found that there are systemd-homed file types, contexts and policies already created in the SELinuxProject / refpolicy project.
My questions is to community members who has SELinux experience - what would be the proper way to add systemd-homed policies from the SELinuxProject/refpolicy project ?
The files containing systemd-homed:

I’m willing to spend time experimenting if someone could give/point to instructions.

Regards
ArtƫrasB.

2 Likes
2

I think probably the best way would be to get those policies from the refences policy included in GitHub - fedora-selinux/selinux-policy: selinux-policy for Fedora is a large patch off the mainline

3

The homed policy addition in the ref are still incomplete and are for reference. The one that’s mentioned in the fedora-selinux policy are also incomplete and not fully tested, hence why they were not merged.

As per SELinux/IndependentPolicy - Fedora Project Wiki

Write his own SELinux policy from scratch and ask SELinux team for policy review.

4

I think probably the best way would be to get those policies from the refences policy included in https://github.com/fedora-selinux/selinux-policy

I agree with you, but the issue is that there is nothing about homed in the Fedora’s SELinux policies :frowning:

We couldn’t find any code matching ‘homed’ in fedora-selinux/selinux-policy

My idea was to “extraxt” homed related stuff from refpolicy and add it to my installation properly (as a custom policy, I guess) so I could test it. Maybe I need to find instructions on how to achieve that


5

Yes, I realize that, but having all elements for systemd-homed in place, except SELinux policies for Fedora, makes me want to help with testing, at least, as I’m not SELinux expert.

1 Like
6
1 Like
7

Sorry, I was unclear — I meant exactly what it looks like you’ve done: submit a PR to take the required policy from the reference implementation and include it in the Fedora version.

8

That’s fine, thanks for explaining.

Anyone could give me hints on how to put a proper PR to get homed reference policies from SELInux refpolicy project into Fedora’ SELinux policy project ? I know how PR works in general, but how to make that cross-project ?

1 Like
9

Quick answer is:

  1. Make a local clone of the reference repo
  2. Fork the Fedora repo
  3. Make a local clone of that fork
  4. In that fork, checkout a new branch git checkout -b systemd-homed
  5. Copy all of the needed files from the reference repo to your local fork of the Fedora repo
  6. git diff to verify the changes
  7. git add all the new and changed files
  8. git commit with a descriptive message
  9. git push back to your fork on github
  10. Make the PR

(I suppose “test that your changes are correct” should be in there somewhere
)