Russell Coker: creating a new SE Linux policy module
Creating a simple SE Linux policy module is not difficult.
audit(1173571340.836:12855): avc: denied execute for pid=5678 comm="spf-policy.pl" name="hostname" dev=hda ino=1234 scontext=root:system_r:postfix_master_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
For example I had a server with the above messages in the kernel message log from the spf-policy program (run from Postfix) trying to run the "hostnme" program. So I ran the following command to generate a .te file (SE Linux policy source):
dmesg grep spf.policy audit2allow -m local > local.te
The -m option to audit2allow instructs it to create a policy module. The local.te file is below:
After creating the module I used the following command to link it with the running policy and load it into the kernel:
semodule -i ./local.pp
audit(1173571340.836:12855): avc: denied execute for pid=5678 comm="spf-policy.pl" name="hostname" dev=hda ino=1234 scontext=root:system_r:postfix_master_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
For example I had a server with the above messages in the kernel message log from the spf-policy program (run from Postfix) trying to run the "hostnme" program. So I ran the following command to generate a .te file (SE Linux policy source):
dmesg grep spf.policy audit2allow -m local > local.te
The -m option to audit2allow instructs it to create a policy module. The local.te file is below:
Then I used the following commands to create a policy module and package it:
module local 1.0;
require
class file execute;
type hostname_exec_t;
type postfix_master_t;
role system_r;
;
allow postfix_master_t hostname_exec_t:file execute;
checkmodule -M -m -o local.mod local.teThe result was the object file local.pp and in intermediate file local.mod (which incidentally can be removed once the build is finished).
semodule_package -o local.pp -m local.mod
After creating the module I used the following command to link it with the running policy and load it into the kernel:
semodule -i ./local.pp
(most recently at 10 am).
I've bought melatonin, and I intend to use it.. Here's hoping for 
sanity.
Reviewers are pretty unanimous about this proposal, as 4.0 is the top grade in our scoring system. The lack of variance suggests that I ought to ensure that all the assigned reviewers put in their scores — this could be just one person voting. 
These next two are the pretty typical distribution for highly graded proposals: mostly top marks and a few average ones. Middle rankingSome of the more interesting trends show up when the scoring isn't biased to either the top or bottom ends of the scale. 
The reviewers are unanimous about this paper's soundness. It's not made anyone go "wow", but there's nothing to grumble about either. 
This proposal clearly polarises opinion, and is such stands a better chance than the unanimous 3.0 above. Perhaps the subject matter or approach is controversial or timely.
Another proposal that divides the reviewers' opinions. It's also worth me checking here that I don't either have a pathologically strict reviewer, or at the other end, a reviewer with a wild passion for the cause this paper advocates. Low scoring The quality of submissions is usually so good that I don't give low graded proposals much attention, but the sparklines could alert me to potential oversights. 
This proposal seems to polarise opinion between "rubbish" and "ok", so it's interesting to me to check out the subject matter and see if I'm missing something with potential. 
These proposals were not received at all well.In summary, I'm delighted to find a solid practical application for sparklines. My thanks to Nat Torkington for the inspiration.