I wrote a service/single binary app that I'm trying to run on Fedora 24, it runs using systemd, the binary is deployed to
this service/app I wrote needs to create/open/read and rename files in this directory.
I first started creating a new policy based on SELinux: allow a process to create any file in a certain directory
but when my app needed to rename, the output had a warning:
#!!!! WARNING: 'var_t' is a base type. allow init_t var_t:file rename;
I googled around and I found out I should use a more specific SELinux label than a base type, but all the examples online show you existing labels from httpd/nginx/etc.
Is there a way I can create a custom label just for my own app?
My idea is to create something like myapp_var_t, use
semanage fcontext -a -t my_app_var_t '/srv/bot(/.*)?' restorecon -R -v /srv/bot
and a custom
.pp file that will use this custom type
If there is a better way to solve it, that works too.
After more searching around I think the proper term for what I want to do is to create new
types which led me to
which basically says, run
and I was able to get a template that I can then compile into a pp file and load, still get some errors but looks like I'm closer to what I want to do.
If I get it to work, I'll update this post