Any idea how to make an OpenVPN in Network Manager...

Any idea how to make an OpenVPN in Network Manager work with #SELinux ?

I have this in audit.log

type=AVC msg=audit(1680707456.828:170): avc: denied { search } for pid=5839 comm="openvpn" name="home" dev="dm-1" ino=256 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

and this error in journalctl

Apr 05 17:11:20 t470 nm-openvpn[5907]: Cannot pre-load keyfile (/home/solene/.cert/ta.key)

if I disable SELinux it works well...

Like 5 Apr 2023 at 15:12 | Open on bsd.network

7 comments

Joshua Lee :kde: :emacs:

@solene use restorecon on the cert file.

5 Apr 2023 at 15:25 | Open on mstdn.starnix.network

Solène :flan_hacker:

@10leej I already tried, sorry for having forgotten about this information. It didn't help :/

5 Apr 2023 at 16:07 | Open on bsd.network

Roberto Alfieri

@solene mmh, try with `sudo setsebool -P openvpn_enable_homedirs 1`

5 Apr 2023 at 15:28 | Open on social.rebtoor.com

Solène :flan_hacker:

@rebtoor I tried that, no change :(

5 Apr 2023 at 16:06 | Open on bsd.network

swagg boi :mastoiddong_gold:

@solene audit2allow returns this policy: https://paste.lgts.xyz/?f398718e8c2ddd19#44Kr3ioS9bA3mJ9bygRTLyPvQ1WfCYRm5PqKtRGGoPLv

5 Apr 2023 at 16:21 | Open on fedi.seriousbusiness.international

zoidb3rg

@solene I had in 2015 a similar issue. Here are my old notes, which solved the problem on Fedora.

-copy ca.crt, client.crt and client.key to ~/.cert
- restorecon -R -v ~/.cert

alternative: setenforce 0

source: https://ask.fedoraproject.org/en/question/31989/there-is-a-conflict-between-selinux-and-openvpn-connection/

5 Apr 2023 at 18:03 | Open on bsd.network

zoidb3rg

@solene oops, the ask.fedora link is not available anymore. Here is the archive.org link

https://web.archive.org/web/20190204050322/https://ask.fedoraproject.org/en/question/31989/there-is-a-conflict-between-selinux-and-openvpn-connection/

5 Apr 2023 at 18:06 | Open on bsd.network