SELinux and FreeRADIUS interplay
hi, whilst working on a test/dev system i noted that the control-socket feature doesnt work if SELinux is running....ponder if anyone has the policy for SELinux to allow this to operate otherwise I'll do some digging when I've next got time to give this community the recipe to allow SELinux to be enforcing and FreeRADIUS to work :-) alan
On 07/13/2009 12:15 PM, A.L.M.Buxey@lboro.ac.uk wrote:
hi,
whilst working on a test/dev system i noted that the control-socket feature doesnt work if SELinux is running....ponder if anyone has the policy for SELinux to allow this to operate otherwise I'll do some digging when I've next got time to give this community the recipe to allow SELinux to be enforcing and FreeRADIUS to work :-)
I recall running into this issue when the control socket was first added and my recollection is that I contacted our SELinux policy guru (Dan Walsh) to add support for it. However neither Dan nor myself has specific memories on this but we think it might have been for Fedora only (not RHEL) if it happened at all. Dan has promised me he will investigate and get back to me. I will follow up here at that time. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
Hi,
I recall running into this issue when the control socket was first added and my recollection is that I contacted our SELinux policy guru (Dan Walsh) to add support for it. However neither Dan nor myself has specific memories on this but we think it might have been for Fedora only (not RHEL) if it happened at all. Dan has promised me he will investigate and get back to me. I will follow up here at that time.
okay - here is the SELinux magic that gets it working. perhaps suitable for WIKI etc. i'm very keen on things working with SELinuxx - its a good tool. okay, after running radiusd a few times and finding out the reason for the failure using audit2why < /var/log/audit/audit.log I built up a local.te file - see attached. this is the 'foo' that SELinux needs for its engine. taking this local.te file i then created a suitable local module checkmodule -M -m -o local.mod local.te semodule_package -o local.pp -m local.mod semodule -i local.pp the radiusd daemon now runs with the control_socket on. hurrah! alan
participants (2)
-
A.L.M.Buxey＠lboro.ac.uk -
John Dennis