What is selinux-policy version on your CentOS 5?
# rpm -q selinux-policy
selinux-policy-2.4.6-316.el5
I am using RedHat supplied openvpn, not the latest one from rpm forge, don't know if your openvpn comes with additional selinux module though.
# rpm -q openvpn
openvpn-2.1.4-1.el5
Fedora 15 latest still uses 2.1.4:
# rpm -q openvpn
openvpn-2.1.4-1.fc15.i686
Is there an openvpn module in the CentOS 5 policy?
# semodule -l | grep open
#
In Fedora 15 there is a module:
# semodule -l | grep openvpn
openvpn 1.10.0
but looking at the policy source I can't find additional permissions.
In any event I managed to craft a module to allow openvpn read shadow file (although Dan Walsh says here:
http://danwalsh.livejournal.com/12333.html?view=290349 that unix_passwd should take care of it which does not appear to be true in my case - openvpn_t still wants to read shadow_t).
# cat openvpnReadShadow.te
module openvpnReadShadow 1.0;
require {
attribute can_read_shadow_passwords;
type openvpn_t;
type shadow_t;
# type initrc_var_run_t;
# type chkpwd_exec_t;
class file { read getattr lock execute execute_no_trans };
class netlink_audit_socket { create write nlmsg_relay read };
class capability audit_write;
}
#============= openvpn_t ==============
typeattribute openvpn_t can_read_shadow_passwords;
#allow openvpn_t chkpwd_exec_t:file { read execute execute_no_trans };
#allow openvpn_t initrc_var_run_t:file { read lock };
allow openvpn_t shadow_t:file { read getattr };
allow openvpn_t self:netlink_audit_socket { create write nlmsg_relay read };
allow openvpn_t self:capability audit_write;
I may try the same on RHEL 6 derivative later to see if there is any difference.
