Dear Maintainer,

I am trying to get this machine to work properly under SELinux enforcing mode,
but run into all kinds of interesting issues.

One of these issues is that etckeeper, when run from cron, tries to read and
write various files in /etc, but this is not allowed by the system_cronjob_t
type the cronjob runs under.

How etckeeper works is that it scans /etc and for each file that was changed,
it commits it into git (or similar). The default path of this repository is
/etc/.git (etc_t). It also wants to modify /etc/.etckeeper and have read access
to each and any file in /etc (except for files that are ignored in
/etc/.gitignore).

I do not think it is wise to grant system_cronjob_t write permission to etc_t
files, and also not wise to grant it read permission to each and any file in
/etc. I'm not sure what the best approach should be, but I think it should
start with a process transion, so that etckeeper runs in its own type.


root@ix:˜# dpkg -l etckeeper
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version      Architecture Description
+++-==============-============-============-=================================
ii  etckeeper      1.15         all          store /etc in git, mercurial, bzr
root@ix:˜#

severity 772828 normal
thanks

I agree that having a separate domain for etckeeper would be a reasonable
idea, although the system_cronjob_t domain has so many permissions that adding
more access probably doesn't make much difference.

I'm giving it severity normal.  One program not working as desired (and doing
so in a way that isn't confusing to the sysadmin) isn't an important bug if
the program isn't essential or commonly used.