Is fwknop compatible with SELinux?
Given that complex programs such as tcpdump and iptables that need specialized system access are compatible with SELinux, fwknop is also compatible. However, there isn’t yet a list of things that need to be altered in an SELinux policy in order to make fwknop work properly. Depending on its configuration, fwknopd may need to execute GnuPG and it may also need to put an interface in promiscuous mode (although this can be controlled with the ENABLE_PCAP_PROMISC variable in the /etc/fwknop/fwknop.conf file). On Linux, fwknopd always needs to execute iptables commands to alter the local iptables policy when a valid SPA packet is seen. If you have fwknop working under SELinux and you don’t mind sharing, please send the steps necessary to get this to work to mbr.at.cipherdyne.org, and I will post these steps here (with attribution of course).
