Skip to content

Comments

Add selinux permissions#109

Merged
Aetf merged 1 commit intoAetf:developfrom
kdj0c:selinux
May 15, 2025
Merged

Add selinux permissions#109
Aetf merged 1 commit intoAetf:developfrom
kdj0c:selinux

Conversation

@kdj0c
Copy link
Collaborator

@kdj0c kdj0c commented Apr 17, 2025

Add proper selinux permissions, tested on Fedora 42.
It only needs to set /usr/bin/kmscon as shell_exec_t, otherwise selinux prevents to start /bin/bash when you login.

Add proper selinux permissions, tested on Fedora 42
It only needs to set /usr/bin/kmscon as shell_exec_t, otherwise
selinux prevents to start /bin/bash when you login.

Signed-off-by: Jocelyn Falempe <[email protected]>
Copy link
Owner

@Aetf Aetf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@Aetf Aetf merged commit 7818619 into Aetf:develop May 15, 2025
@ca-hu
Copy link

ca-hu commented Aug 4, 2025

fyi there is already a fedora selinux-policy upstream kmscon module, why wasn't it used? they might need to enable it or you likely can also ask them if you can take it over
https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/kmscon.te

Also, we worked on some fixes for kmscon 9, just created a PR there
fedora-selinux/selinux-policy#2813

@kdj0c
Copy link
Collaborator Author

kdj0c commented Aug 4, 2025

@ca-hu I wasn't aware that there was an upstream selinux-policy for kmscon.
Before writing this, I asked how to do that here
https://discussion.fedoraproject.org/t/selinux-configuration-for-kmscon/140141

Do you have an example of the changes required to use the fedora selinux-policy?

Also FYI, I'm reviving the kmscon/libtsm packages for Fedora:
https://bugzilla.redhat.com/show_bug.cgi?id=2373136
https://bugzilla.redhat.com/show_bug.cgi?id=2373128

@ca-hu
Copy link

ca-hu commented Aug 4, 2025

Do you have an example of the changes required to use the fedora selinux-policy?

If the fedora selinux policy maintainers decide to activate the module, then it likely will come with the distribution and I think you can just drop the selinux stuff here and it will just work.
I think if you want to carry it as independent policy module you likely need to copy it over and maintain it yourself.
Since I am not involved in fedora nor kmscon, maybe you could discuss this with them directly there: fedora-selinux/selinux-policy#2813

@kdj0c kdj0c deleted the selinux branch October 10, 2025 09:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants