{"action":"created","issue":{"url":"https://api.github.com/repos/duosecurity/duo_unix/issues/114","repository_url":"https://api.github.com/repos/duosecurity/duo_unix","labels_url":"https://api.github.com/repos/duosecurity/duo_unix/issues/114/labels{/name}","comments_url":"https://api.github.com/repos/duosecurity/duo_unix/issues/114/comments","events_url":"https://api.github.com/repos/duosecurity/duo_unix/issues/114/events","html_url":"https://github.com/duosecurity/duo_unix/pull/114","id":307065220,"node_id":"MDExOlB1bGxSZXF1ZXN0MTc2MzQyODEw","number":114,"title":"Significantly overhaul SELinux support.","user":{"login":"qralston","id":6080390,"node_id":"MDQ6VXNlcjYwODAzOTA=","avatar_url":"https://avatars1.githubusercontent.com/u/6080390?v=4","gravatar_id":"","url":"https://api.github.com/users/qralston","html_url":"https://github.com/qralston","followers_url":"https://api.github.com/users/qralston/followers","following_url":"https://api.github.com/users/qralston/following{/other_user}","gists_url":"https://api.github.com/users/qralston/gists{/gist_id}","starred_url":"https://api.github.com/users/qralston/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qralston/subscriptions","organizations_url":"https://api.github.com/users/qralston/orgs","repos_url":"https://api.github.com/users/qralston/repos","events_url":"https://api.github.com/users/qralston/events{/privacy}","received_events_url":"https://api.github.com/users/qralston/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-03-20T22:43:27Z","updated_at":"2018-06-21T17:17:30Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/duosecurity/duo_unix/pulls/114","html_url":"https://github.com/duosecurity/duo_unix/pull/114","diff_url":"https://github.com/duosecurity/duo_unix/pull/114.diff","patch_url":"https://github.com/duosecurity/duo_unix/pull/114.patch"},"body":"Specifically:\r\n\r\nMove authlogin_duo.te from the pam_duo subdirectory to a separate selinux subdirectory. Conditionally add the selinux subdirectory to SUBDIRS in the top-level Makefile.am, depending on whether configure finds the prerequisite SELinux development tools installed on the system. If configure finds the tools, use them to build the module.\r\n\r\nRewrite the authlogin_duo policy module to use SELinux tunable policies to fine-tune SELinux behavior.\r\n\r\nUsing SELinux tunable policies (i.e., booleans) permits the system administrator to adjust the SELinux policy to match the precise configuration of Duo on the system. This is a better approach than having the authlogin_duo policy module blindly grant every possible SELinux type that could possibly use Duo authentication the ability to make outbound TCP connections.\r\n\r\nThe two initial tunable policies are pam_duo_permit_sshd and pam_duo_permit_local_login, which control whether the sshd_t and local_login_t types (respectively) can make outbound TCP connections to ports with the http_port_t or http_cache_port_t label.\r\n\r\nAdditional tunable policies can be created as needed (e.g., pam_duo_permit_xdm)."},"comment":{"url":"https://api.github.com/repos/duosecurity/duo_unix/issues/comments/399179056","html_url":"https://github.com/duosecurity/duo_unix/pull/114#issuecomment-399179056","issue_url":"https://api.github.com/repos/duosecurity/duo_unix/issues/114","id":399179056,"node_id":"MDEyOklzc3VlQ29tbWVudDM5OTE3OTA1Ng==","user":{"login":"qralston","id":6080390,"node_id":"MDQ6VXNlcjYwODAzOTA=","avatar_url":"https://avatars1.githubusercontent.com/u/6080390?v=4","gravatar_id":"","url":"https://api.github.com/users/qralston","html_url":"https://github.com/qralston","followers_url":"https://api.github.com/users/qralston/followers","following_url":"https://api.github.com/users/qralston/following{/other_user}","gists_url":"https://api.github.com/users/qralston/gists{/gist_id}","starred_url":"https://api.github.com/users/qralston/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qralston/subscriptions","organizations_url":"https://api.github.com/users/qralston/orgs","repos_url":"https://api.github.com/users/qralston/repos","events_url":"https://api.github.com/users/qralston/events{/privacy}","received_events_url":"https://api.github.com/users/qralston/received_events","type":"User","site_admin":false},"created_at":"2018-06-21T17:17:30Z","updated_at":"2018-06-21T17:17:30Z","author_association":"NONE","body":"Hi @xdesai,\r\n\r\nUnderstood. I think this pull request is now in the state that we both agree on: SELinux support isn't enabled unless `--with-selinux` is passed to `configure`.\r\n\r\nPlease let me know if your review encounters any issues. Thanks!"}}
{"actor":{"display_login":"qralston"}}