Make Jobe work with SELinux

[julesfm]

It appears at the moment that the docs largely say "don't try this, disable SELinux". However, disabling SELinux is not an option here, our IT department won't let us. So I set about getting it working.

First, create a new SELinux module for CodeRunner.
Place the attached file into /usr/share/selinux/targeted/coderunner.te.
(It's just plain text. I had to rename it with a ".txt" extension added on the end to make Github allow me to upload it here, remove the ".txt" off the end.

coderunner.te.txt

Then compile and load the new module:

rm coderunner.mod coderunner.pp
semodule -r coderunner
checkmodule -m -M -o coderunner.mod coderunner.te
semodule_package -o coderunner.pp -m coderunner.mod
semodule -i coderunner.pp

Set some booleans to enable various SELinux features to do with httpd:

setsebool -P httpd_execmem 1
setsebool -P httpd_setrlimit 1
setsebool -P httpd_mod_auth_pam 1
setsebool -P httpd_read_user_content 1

Add some SELinux tags to make runguard uncontrolled, and to tell SELinux to use the /home/jobe dirs correctly:

semanage fcontext --add -s system_u -t httpd_unconfined_script_exec_t '/var/www/html/jobe/runguard/runguard'
semanage fcontext --add -s unconfined_u -t user_home_t '/home/jobe/files(/.*)?'
semanage fcontext --add -s system_u -t httpd_sys_rw_content_t '/var/www/html/jobe/writable(/.*)?'
restorecon -FRv /var/www/html/jobe /home/jobe

You should then either be able to just reboot, or else just

systemctl restart php-fpm httpd

to restart the relevant daemons.

This is the setup I run here on RHEL 9.

Cheers,
Jules.

[trampgeek]

Thanks Jules. I'm happy to add a section to the install instructions on how to use SELinux. But Idon't wish to have to maintain the coderunner.te module or the associated instructions, as I don't use SELinux and would have no way of checking the validity of the instructions.

So would you be able to set up your own github repo containing just your SELinux file together with the instructions on how to use it, please? I can then add a section to the Jobe instructions with a heading like "Running Jobe on SELinux, which is essentially just a link to your repo.