4

I'm new to SELinux and it is giving me a headache. I have a python service that runs a python script on my home directory (my_script.py). I've been running the service, seeing what aspect of it SELinux is blocking, and adding a new SElinux module

    allow this access for now by executing:
# ausearch -c 'my_script.py' --raw | audit2allow -M my_script
# semodule -X 300 -i my_script.pp

However, each time I add a new module it keeps blocking another aspect of my script (reading files, writing files, then reading a socket etc.) I believe I have like 10 modules now, and I'm having trouble keeping track of all of them. I'm also worried that down the road my script might do something that SELinux doesn't like, but didn't come up during testing. Is there a way to tell SELinux, please let my_script.py do whatever it wants (read, write, rename, etc.)? I am about to just disable SELinux, but really would rather not. Thanks!

1 Answer 1

2

Yes, you can. Create your own SELinux domain (mypythonapp_t) and make that domain permissive. Files tagged with a label belonging to a permissive domain are allowed to perform all actions and are as such excluded from the SELinux enforcement. You can run your app permissive whilst the rest of the system is still protected by SELinux.

See https://selinuxproject.org/page/PermissiveDomainRecipe, https://danwalsh.livejournal.com/24537.html. For an excellent guide on how to create your own policy, see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/writing-a-custom-selinux-policy_using-selinux.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .