@kenkendk , during my first on-disk backup since the upgrade to v2.1.0.2, I found a few other SELinux policies which required my attention when running on Fedora 41.
For BackendAsyncW:
module my-BackendAsyncW 1.0;
require {
type unreserved_port_t;
type unlabeled_t;
type init_t;
class tcp_socket name_connect;
class dir remove_name;
class file unlink;
}
allow init_t unlabeled_t:dir remove_name;
allow init_t unlabeled_t:file unlink;
allow init_t unreserved_port_t:tcp_socket name_connect;
Then duplicatiserve:
module my-duplicatiserve 1.0;
require {
type tmp_t;
type admin_home_t;
type init_t;
class process getsession;
class fifo_file create;
class file create;
}
allow init_t admin_home_t:file create;
allow init_t self:process getsession;
allow init_t tmp_t:fifo_file create;
Then NETTPWorker:
module my-NETTPWorker 1.0;
require {
type unlabeled_t;
type init_t;
type http_port_t;
type user_home_t;
class tcp_socket name_connect;
class file { create lock open read write };
class dir add_name;
}
allow init_t http_port_t:tcp_socket name_connect;
allow init_t unlabeled_t:dir add_name;
allow init_t unlabeled_t:file create;
allow init_t unlabeled_t:file write;
allow init_t user_home_t:file { lock open read };
Because of an additional sync-script I run after the backup job, I needed these policies for WorkerThreadIR, too:
module my-WorkerThreadIR 1.0;
require {
type user_home_t;
type init_t;
class lnk_file read;
class file { execute execute_no_trans };
}
allow init_t user_home_t:file execute;
allow init_t user_home_t:file execute_no_trans;
allow init_t user_home_t:lnk_file read;
The script uses rsync, for which I had to add yet another custom SELinux policy:
module my-rsync 1.0;
require {
type config_home_t;
type unlabeled_t;
type rsync_t;
type user_home_dir_t;
class file write;
class dir search;
class capability dac_override;
}
allow rsync_t config_home_t:file write;
allow rsync_t self:capability dac_override;
allow rsync_t unlabeled_t:dir search;
allow rsync_t user_home_dir_t:dir search;
Note: perhaps all these additional policies are not necessary on a vanilla installed, brand new system. Perhaps I have configured it to pieces, or something when awry on the update from Fedora 40 to 41. All I know at this moment, is that it works without any errors or warnings. But I do get the feeling I might have used a sledgehammer where a scalpel would have sufficed.
Could someone with insights into SELinux shed some light on this? Should my disks, folders and files be reconfigured, relabeled or what not?
Thanks, kind regards,
FWieP