If you were running setroubleshoot, it would have told you this.

BLAM, I am bu…red. SeLinux has decided to to stop ZenCart talking to MySQL. I can understand why but now I have to spend most of another day making a policy file.

Will you guys who write this stuff please learn that normal people will never get seriously into Linux while you leave all these little exercises in masochism in the software. Bill Gates must be laughing all the way to the bank yet again.

Fortunately I do not need SELinux at home so out it goes for now.

I have been reading alot of your journals and howto’s on the web and fine them extremely usefull, thank you very much.

I’ll address the mailing list for more questions, seems like a better fora for more basic issues like this.

An interface should have been created in the if file called
myapp_domtrans.

So you could add to your te file,

gen_require (`
type unconfined_t;
‘)
myapp_domtrans(unconfined_t)

Of you could simply add these lines to your code.

domain_auto_trans(unconfined_t,myapp_exec_t,myapp_t)

allow unconfined_t myapp_t:fd use;
allow myapp_t unconfined_t:fifo_file rw_file_perms;
allow myapp_t unconfined_t:process sigchld;

I am writing a new application that I want to tie down as strict as reasonable using SELinux.

the gui worked nicely and set up the files needed to compile the selinx module. (i just had to add “type myapp_t;” since that did not already exist)

However… it also granted the app
corecmd_executable_file(myapp_exec_t)

And trial and error concluded that this one single rule allowed the app to do whatever it pleased… All other selinux settings, network ports etc.. as generated by the GUI had no real effect as long as that one single rule was in the source.

If i remove that one particular rule and run audi2dallow, it suggests:
allow unconfined_t myapp_exec_t:file { ioctl relabelfrom execute read getattr execute_no_trans };

.. which by my limited understanding seems way to broad, ie basically the let the app do anything. Wtih that one rule in the source the app was again allowed to do anything.

where do I go from here..

Cheers