bottlerocket-os / bottlerocket-os/bottlerocket
Add `allow2audit` to images
- Dominant language
- Rust
- Stars
- 9.7k
- Forks
- 586
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 12
Description
Hi folks,
It'd be nice if Bottlerocket images included the selinux `audit2allow` tool. Adding this tool would make writing policies and discovering what permissions a process needs significantly easier. A lot of related tools have already been added, and I _think_ all prerequisites except for `audit2why.so`, which is a built from the `libselinux` source.
Unfortunately, while `audit2allow` is available via an Amazon Linux 2 package, it's not compatible with the selinux policy version 33 that's included with recent images.
**What I'd like:** I'd like the `allow2audit` utility to be included in Bottlerocket images
**Any alternatives you've considered:** Building from source. This is possible to do but pretty painful.
Contributor guide
Research direction
Start by reviewing how the related SELinux tools are already added to Bottlerocket images and investigate the libselinux source for the missing audit2why.so prerequisite. Confirm the requested audit2allow utility is compatible with policy version 33, then verify it is present and usable in a built image.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- build-system, operating-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100