From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74DC3C2BA2B for ; Fri, 10 Apr 2020 05:56:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1E88D20801 for ; Fri, 10 Apr 2020 05:56:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b="LWGEC7la" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725776AbgDJF4e (ORCPT ); Fri, 10 Apr 2020 01:56:34 -0400 Received: from smtp.sws.net.au ([46.4.88.250]:60812 "EHLO smtp.sws.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725839AbgDJF4e (ORCPT ); Fri, 10 Apr 2020 01:56:34 -0400 Received: from liv.localnet (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id B1F58FC5B; Fri, 10 Apr 2020 15:56:31 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1586498192; bh=P8MrmJbxOTDahbX++QojDqqgaGwlpMMhcVemxOV4ToM=; l=1271; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LWGEC7laakznocQ86REdVIEGvdMlTDupoKFXAax15LcGriy/ln5VfrQAA/7cKhtKZ KD/bGJjUNkbanwz9JMdLTjk7vqdojQB9ysIGwEBtCIyIqMUdKxZ3IOFkLx/0CGXkaL 6Gf9B+FbhzYa/DvvTeOfaE79PmVQEhEIv7OThk0Q= From: Russell Coker To: Chris PeBenito Cc: selinux-refpolicy@vger.kernel.org Subject: Re: new certbot patch Date: Fri, 10 Apr 2020 15:56:26 +1000 Message-ID: <4305733.qMCtAaFjtT@liv> In-Reply-To: <5b70567f-d551-ea5f-50e4-5febe2ad9a09@ieee.org> References: <20200405084141.GA177560@xev> <5b70567f-d551-ea5f-50e4-5febe2ad9a09@ieee.org> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On Thursday, 9 April 2020 11:23:00 PM AEST Chris PeBenito wrote: > > +miscfiles_read_generic_certs(certbot_t) > > +miscfiles_manage_generic_tls_privkey_dirs(certbot_t) > > +miscfiles_manage_generic_tls_privkey_files(certbot_t) > > +miscfiles_manage_generic_tls_privkey_lnk_files(certbot_t) > > Perhaps we should be moving towards having a specific label for these > private keys instead. It seems logical that there would be multiple types > of private keys. Then have a miscfiles_private_key() to declare one and > have the type in this module to act on directly. Certbot isn't written to support different runs on the same system. It might be worth filing an upstream feature request for that as it would be a useful feature. As for SE Linux policy to support multiple separate private SSL keys on the same system, it seems that there would be many variations on that and trying to write generic policy wouldn't be viable. Maybe a better solution would be to support different MCS categories for different daemons and then different categories for private keys. Then the sysadmin would have full control over which daemons could access which private keys. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/