# OnDemand SELinux - additional permissions?

**URL:** <https://discourse.openondemand.org/t/ondemand-selinux-additional-permissions/2845>\
**Category:** Get Help\
**Tags:** question\
**Created:** [August 1, 2023, 9:07am UTC](https://discourse.openondemand.org/t/ondemand-selinux-additional-permissions/2845 "2023-08-01T09:07:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ghferrari](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ghferrari/32/1064_2.png) [@ghferrari](https://discourse.openondemand.org/u/ghferrari)\
**Post date:** [August 1, 2023, 9:07am UTC](https://discourse.openondemand.org/t/ondemand-selinux-additional-permissions/2845/1 "2023-08-01T09:07:58Z")

</div>

This post is a long-delayed follow up to [Permission denied rb\_file\_s\_lstat with SELinux and local home directories](https://discourse.openondemand.org/t/permission-denied-rb-file-s-lstat-with-selinux-and-local-home-directories/2338).

I’m running OnDemand on Rocky Linux 8 with local (i.e. non-NFS) home folders on the OnDemand server and connected to fairly standard small Slurm cluster. I’ve already set the `ondemand_manage_user_home_dir=1` and `ondemand_use_nfs=0` SE booleans.

Based on my testing this week, the following additional SELinux permissions are required (presented here in the form of a readable policy):

```auto
require {
        type ood_pun_t;
        type user_home_t;
        type user_home_dir_t;
        type net_conf_t;
        type httpd_t;
        class lnk_file { read create getattr setattr };
        class dir {getattr read};
        class file { ioctl open read };
        class capability net_admin;
        type faillog_t;                                                                                                        
        type sssd_conf_t
}

#============= ood_pun_t ==============
allow ood_pun_t net_conf_t:lnk_file read;
allow ood_pun_t user_home_dir_t:lnk_file { read create getattr setattr };
allow ood_pun_t user_home_t:dir read;
allow ood_pun_t user_home_t:file { read ioctl open };

#============= httpd_t ==============
allow httpd_t self:capability net_admin;
allow httpd_t faillog_t:dir write;
allow httpd_t sssd_conf_t:file read;

```

In addition, I also needed to set `sudo setsebool -P domain_can_mmap_files 1`.

I don’t know if these additional permissions are more generally applicable - perhaps the developers can comment.

Many thanks!

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [August 1, 2023, 5:11pm UTC](https://discourse.openondemand.org/t/ondemand-selinux-additional-permissions/2845/2 "2023-08-01T17:11:43Z")

</div>

The things that got denied using `httpd_t` shouldn’t be related to OnDemand directly as OnDemand runs via the PUN (Per-User-NGINX) and that entire stack is forced to be `ood_pun_t`. There could be situations where Apache is doing things that might otherwise be denied but none of those `httpd_t` allowances look related to local home directories and might just be normal things that Apache gets denied doing when SELinux is enabled.

The `ondemand_manage_user_home_dir` boolean has allowances for the `user_home_dir_t` labeled locations. I would be interested to know what in your local home directories are using `user_home_t` and if that’s the correct context, ie if you do `restorecon -n -v` on those paths, does the context show it will change?

The `ood_pun_t` allowance for `net_conf_t` looks unrelated to local home directories so the actual audit log denial for that would be needed so hopefully better understand what denial is happening.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [January 28, 2024, 5:12pm UTC](https://discourse.openondemand.org/t/ondemand-selinux-additional-permissions/2845/3 "2024-01-28T17:12:22Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.