"I'll just move my state dir to /var/lib like other system services, that should make it all work"

Amber

@[email protected] yeah i am so glad people actually enjoy making selinux policies for the programs i use otherwise i couldn't do squat

Amber

@[email protected] people writing SELinux policies, PAM modules & packaging software are the unappreciated custodial staff of *nix.

Dave Anderson

@puppygirlhornypost2 I'm also kinda shocked as I browse the live policy loaded into my laptop, I thought there wasn't that much lockdown going on aside from network-facing services, but my god there's a zillion type_transition rules from init_t to other stuff!

Trying to run icecast? Sure, I got a narrowly scoped happy path for that. Starting a login prompt? Hell yeah special confinement rules for that. Running an ancient sound server from 1998? Believe it or not, bespoke ruleset is yes.

Dave Anderson

@puppygirlhornypost2 And I guess I shouldn't be that surprised, but turns out the sort of people who write policies for mandatory access control systems didn't leave any obvious "oh you want to yolo? Sure, here you go, have some yolo"

Irenes (many)

@danderson @puppygirlhornypost2 this is fascinating, we feel like we're learning quite a bit about SELinux from the discussion. thank you!

Amber

@[email protected] @[email protected] yeah, it's even weirder because selinux has "profiles" governing how strict you want it to be.

Dave Anderson

Okay so I had the right idea _broadly_. I need to mark the executables I'm trying to run as 'bin_t', which is the default "executable not covered by more targeted policies" security label. systemd's SELinux domain (init_t) has a transition rule that allows it to execute bin_t binaries, and when it does those binaries transition to unconfined_t, aka "SELinux won't bother you too much, you just get old school unix DAC enforcement".

But hmm can I mark all my shit as bin_t or do I need subtlety...

Amber

@[email protected] @[email protected] sorry "Contexts" and "Policies"

CatSalad🐈🥗 (D.Burch) :blobcatrainbow:

@puppygirlhornypost2 @danderson @ireneista sexlinux is best thoug– oooh... selinux. Yeah, that's cool too, I guess. >_>

Amber

@[email protected] @[email protected] @[email protected] that's just debian, the distribution for lesbians