bottlerocket-os / bottlerocket-os/bottlerocket

Add `allow2audit` to images

Open
#4,065 7 comments 1 reaction 0 assignees View on GitHub
status/needs-triage type/enhancement
Dominant language
Rust
Stars
9.7k
Forks
586
Avg merge
1d 18h
Merged PRs (30d)
12

Description

Hi folks,

It'd be nice if Bottlerocket images included the selinux `audit2allow` tool. Adding this tool would make writing policies and discovering what permissions a process needs significantly easier. A lot of related tools have already been added, and I _think_ all prerequisites except for `audit2why.so`, which is a built from the `libselinux` source.

Unfortunately, while `audit2allow` is available via an Amazon Linux 2 package, it's not compatible with the selinux policy version 33 that's included with recent images.

**What I'd like:** I'd like the `allow2audit` utility to be included in Bottlerocket images

**Any alternatives you've considered:** Building from source. This is possible to do but pretty painful.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing how the related SELinux tools are already added to Bottlerocket images and investigate the libselinux source for the missing audit2why.so prerequisite. Confirm the requested audit2allow utility is compatible with policy version 33, then verify it is present and usable in a built image.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
build-system, operating-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.