tailscale-selinux-policy

SELinux policy for Tailscale

Supported environment

1. Fedora 37

Supported features

1. Service Start and Stop
2. Tailscale SSH for unconfined users only

Steps to build

Pre-requisites

dnf install selinux-policy-devel

Clone the policy source

git clone [email protected]:abhiseksanyal/tailscale-selinux-policy.git
cd tailscale-selinux-policy
make -f /usr/share/selinux/devel/Makefile tailscaled.pp

This will create the policy file "tailscaled.pp"

Steps to test

Environment tested on

• Tailscale 1.34.2
• Fedora 37
• Kernel 6.1.6-200.fc37.x86_64

1 - Check context of an unconfined Tailscale service

ps -q $(pidof tailscaled) -o pid,label,comm

Output will be something like

    PID LABEL                                     COMMAND
 221929 system_u:system_r:unconfined_service_t:s0 tailscaled

NOTE: You can also run something like ps -eafZ

Stop tailscale service

sudo systemctl stop tailscaled

2 - Load the SELinux policy

sudo semodule -i tailscaled.pp

3 - Set the context for Tailscale files

sudo restorecon /usr/sbin/tailscaled
sudo restorecon /lib/systemd/system/tailscaled.service
sudo restorecon -R /var/lib/tailscale
sudo restorecon -R /var/run/tailscale

This is required only once, until Tailscale is reinstalled

NOTE: Ignore restorecon error, if it fails to find "/var/run/tailscale"

4 - Start Tailscale and check the context again

Start tailscale service

sudo systemctl start tailscaled

Check the context

ps -q $(pidof tailscaled) -o pid,label,comm

Output will be something like

    PID LABEL                             COMMAND
 222705 system_u:system_r:tailscaled_t:s0 tailscaled

NOTE: You can also run something like ps -eafZ

Tailscale service is now running as a confined service with a context of "tailscaled_t"

Steps to revert and unload the SELinux policy

1. Stop tailscale service
2. Unload the SELinux policy using the following command

sudo semodule -r tailscaled

3. Restore the context for Tailscale files

sudo restorecon /usr/sbin/tailscaled
sudo restorecon /lib/systemd/system/tailscaled.service
sudo restorecon -R /var/lib/tailscale
sudo restorecon -R /var/run/tailscale

NOTE: Ignore restorecon error, if it fails to find "/var/run/tailscale"

4. Start tailscale service

Troubleshooting

Ref - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/troubleshooting-problems-related-to-selinux_using-selinux