Re: Run rpm %preun script in unconfined SELinux context

2020-05-10 Thread Sam Varshavchik
Samuel Sieb writes: On 5/9/20 9:45 PM, Sam Varshavchik wrote: There is no issue using "systemctl stop" to stop the entire group of processes, only with using a script that attempts to signal one of process to gracefully shut itself down. Looking for ideas how to get this working. I think I

Re: Run rpm %preun script in unconfined SELinux context

2020-05-10 Thread Sam Varshavchik
Gordon Messmer writes: On 5/9/20 9:45 PM, Sam Varshavchik wrote: Raw Audit Messages type=AVC msg=audit(1589082060.526:1156): avc:  denied  { signal } for  pid=672912 comm="courierlogger" scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_

Re: Run rpm %preun script in unconfined SELinux context

2020-05-09 Thread Gordon Messmer
On 5/9/20 9:45 PM, Sam Varshavchik wrote: Raw Audit Messages type=AVC msg=audit(1589082060.526:1156): avc:  denied  { signal } for  pid=672912 comm="courierlogger" scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process

Re: Run rpm %preun script in unconfined SELinux context

2020-05-09 Thread Samuel Sieb
On 5/9/20 9:45 PM, Sam Varshavchik wrote: There is no issue using "systemctl stop" to stop the entire group of processes, only with using a script that attempts to signal one of process to gracefully shut itself down. Looking for ideas how to get this working. I think I need a way to run %preun

Re: Run rpm %preun script in unconfined SELinux context

2020-05-09 Thread Ed Greshko
On 2020-05-10 12:45, Sam Varshavchik wrote: > My knowledge and understanding of selinux is not very deep, but I'm trying to > run the box in enforcing mode. > > A %preun script in my rpm package is failing. It's running a binary that > sends a signal to a running process, and SELinux blocks the s

Run rpm %preun script in unconfined SELinux context

2020-05-09 Thread Sam Varshavchik
My knowledge and understanding of selinux is not very deep, but I'm trying to run the box in enforcing mode. A %preun script in my rpm package is failing. It's running a binary that sends a signal to a running process, and SELinux blocks the signal: Raw Audit Messages type=AVC msg=audit(158