@mbomb007 well adding an alias in forth is trival, I'm sure you can fork it and add them yourself ;)

@Dennis is bin_t appropriate on /srv/wrappers folder? or should it be on each individual file in this folder instead?

@Dennis, what is the difference between semanage fcontext -a -t usr_t '/opt' and semanage fcontext -a -t usr_t '/opt(/*)?'?

the former gives me a error

@AndrewSavinykh Yes, directory and contents should be bin_t.

not sure why

@AndrewSavinykh The former applies to /opt, the latter to its files. The former probably doesn't work because there's already a rule for /opt.

Note that /opt is usr_t anyway, so you don't have to modify it.

How do I find out?

ah

okay

thank you

so when I label empty /srv/bin and /srv/wrappers, I do not need the (/*)? tail? After that when I pull from git, the files are supposed to be labeled by the nature of residing in the respective folders, right?

/opt is already set up the way you need to.

No need to change anything.

@Dennis yes, I understood that, thank you. I'm asking now about /srv/bin and /srv/wrappers

when saying "pulling from git" I mean the arena repository

sorry keep forgetting that you are pushing

I don't think files inherit a label from their directories, but quite frankly, I'm not sure.

@Dennis ok thank you, I'll find out

Wait.

@AndrewSavinykh There's already a /srv/.* rule that would apply to the contents of /srv/bin, so you need /srv/bin(/.*)?.

The file names get matched against a regular expression, not a directory structure. /srv/.* matches everything in /srv and its subdirectories.

ok, how do you know that? is there a command to run to see that?

I mean that there is a rule for /srv

semanage fcontext -l | grep /srv

Don't forget to grep. The list is really long.

@Dennis is it ok if my interpreter requires Java 9 to run?

@Pavel Not sure. I'd have to see where I can get that from, and if it plays nice along Java 8.

If you try to execute JShell, bash should tell you it's not there and where you can get Java 9.

I don't think it would cause any problems. Everything that works on Java 8 works the same as in Java 9 (albeit with better performance), but even if something borks you can have both installed at the same time withut issues.

sudo apt install openjdk-9-jdk-headless

Or here

I'll check it out tomorrow.

It's not urgent, but I need to know if I can make use of Java 9's features.

@Dennis, I labeled the file.

I'm still getting denied

type=AVC msg=audit(1484717379.817:279): avc: denied { execute } for pid=1173 comm="seunshare" name="wrapper-legacy" dev="vda1" ino=265569

scontext=unconfined _u:unconfined_r:sandbox_t:s0-s0:c6,c123,c189,c198 tcontext=unconfined_u:object_r :var_t:s0 tclass=file permissive=0

tcontext shows var_t. Should it not be bin_t?

@AndrewSavinykh Weird. I'm not sure why it would say var_t. Is /srv/bin labeled bin_t as well?

I have to go get some sleep now. I'll be back later.

@AndrewSavinykh I think matchpathcon only shows the default context, not the one that has been applied. You can check the context with ls -lZ /srv/bin/wrapper-legacy and apply the defaults recursively with restorecon -Rv /srv/bin.

@Dennis Thank you for you continuing support, I got it working finally. The latest version of the doco is here When you have a moment could you please review and let me know any feedback. Thanks!

@Dennis Thanks for providing Haskell on tio.run/nexus! I noticed that some functions like pure or <$> are not present in Prelude, so I assume the ghc version used is 7.8 or lower. Is it possible to update to ghc 7.10 or 8.0 where those functions are contained in Prelude?

@Laikoni I'll see what I can do.

@AndrewSavinykh That looks good. I won't be able to confirm every detail for the arena until I actually set one up, but if memory serves, it's quite similar to what I did.

chmod ug-w ~runner is not enough to prevent runner from modifying its home directory though, as it could undo the change with chmod ug+w ~. As root, chattr +i ~runner will make the directory immutable, and only root can undo the operation.

@Dennis Do I need both chmod and chattr?

or just chattr?

Just chattr. Immutability takes precedence over anything else.

Even root cannot modify an immutable file/directory without revoking immutability first.

@Dennis Thanks, so now when this is done, where do you think we should host these notes? I can understand that you might not want to include it in any of your repos because you have little interest in keeping them up to date, but may be you could create a separate repo just for the notes under tryitonline github user and give me access to this repo? What do you think?

I'll think about it. Both a dedicated repo and a wiki would make sense.

@Dennis let me know