News for hackers. Stuff that matters.
Re:SELinux is unmanageable; just turn it off if it gets in y... by patrck on Wednesday April 27, 2022 @02:11AM (#31176866)
A couple sysadm red flags:

1) The article author is Testing in PROD

2) selinux debugging relies on auditd, so sanity checks required.

  df -P /var/log/audit # has space?
  tail -1 /var/log/audit/audit.log # is recent?
  semodule -DB  # disable dontaudit
  setenforce 0
  # run the failing test
  audit2allow -l
After which the selinux debugging experience boils down to:

    mk_semod() {
        module_name=$1; shift
        audit2allow -l -m ${module_name} -a > ${module_name}.te
        $EDITOR ${module_name}.te || return
        checkmodule -M -m -o ${module_name}.mod ${module_name}.te
        semodule_package -o ${module_name}.pp -m ${module_name}.mod
        semodule -i ${module_name}.pp
    }
Re:SELinux is unmanageable; just turn it off if it gets in y... by kelnos on Wednesday April 27, 2022 @05:25AM (#31177970)
I think you just proved the author's point. That looks entirely inscrutable.