Hi!
I discovered more problems with SELinux. I will describe each and wait for
your comment ;-)
This is all on a fresh clean install of FC2 with SELinux enabled. ( I did
once run "fixfiles relabel" )
========
root under context root:staff_r:staff_t can not use rpm -q :
NOTE: onyl when writing this mail I noticed, that it actually prints
the expected output. Are the audit messages a problem ?
I think I did not see them when running under the root:sysadm_r:sysadm_t
context
Fedora Core release 2 (Tettnang)
Kernel 2.6.5-1.358 on an i686
localhost login: root
Password:
Your default context is root:sysadm_r:sysadm_t.
Do you want to choose a different one? [n]y
[2] root:staff_r:staff_t
Enter number of choice: 2
Last login: Fri Jun 11 19:37:37 on tty2
[root@localhost root]# rpm -q kernel
audit(1086975532.470:0): avc: denied { dac_override } for pid=2612
exe=/usr/lib/rpm/rpmq capability=1 scontext=root:staff_r:staff_t
tcontext=root:staff_r:staff_t tclass=capability
audit(1086975532.470:0): avc: denied { dac_read_search } for pid=2612
exe=/usr/lib/rpm/rpmq capability=2 scontext=root:staff_r:staff_t
tcontext=root:staff_r:staff_t tclass=capability
audit(1086975532.472:0): avc: denied { dac_override } for pid=2612
exe=/usr/lib/rpm/rpmq capability=1 scontext=root:staff_r:staff_t
tcontext=root:staff_r:staff_t tclass=capability
audit(1086975532.472:0): avc: denied { dac_read_search } for pid=2612
exe=/usr/lib/rpm/rpmq capability=2 scontext=root:staff_r:staff_t
tcontext=root:staff_r:staff_t tclass=capability
audit(1086975532.489:0): avc: denied { dac_override } for pid=2612
exe=/usr/lib/rpm/rpmq capability=1 scontext=root:staff_r:staff_t
tcontext=root:staff_r:staff_t tclass=capability
audit(1086975532.489:0): avc: denied { dac_read_search } for pid=2612
exe=/usr/lib/rpm/rpmq capability=2 scontext=root:staff_r:staff_t
tcontext=root:staff_r:staff_t tclass=capability
kernel-2.6.5-1.358
kernel-2.4.22-1.2061.nptl
[root@localhost root]#
========
grub fails with the default root root:sysadm_r:sysadm_t :
[root@localhost root]# grub
Probing devices to guess BIOS drives. This may take a long time.
audit(1086973995.955:0): avc: denied { read } for pid=2576 exe=/sbin/grub
name=linux dev=hde2 ino=148612 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:usr_t tclass=file
Error opening terminal: linux.
[root@localhost root]#
it works with [2] root:staff_r:staff_t
grub-install does not work at all :
[root@localhost root]# grub-install /dev/hde # this is root:staff_r:staff_t
audit(1086974024.461:0): avc: denied { write } for pid=3140 exe=/bin/rm
name=grub dev=hde1 ino=9841 scontext=root:staff_r:staff_t
tcontext=system_u:object_r:boot_t tclass=dir
rm: cannot remove `/boot/grub/stage1': Permission denied
[root@localhost root]#
[root@localhost root]# grub-install /dev/hde # root:sysadm_r:sysadm_t
audit(1086974089.530:0): avc: denied { read } for pid=3193 exe=/bin/cp
name=stage1 dev=hde2 ino=180241 scontext=root:sysadm_r:bootloader_t
tcontext=system_u:object_r:usr_t tclass=file
cp: cannot open `/usr/share/grub/i386-redhat/stage1' for reading: Permission
denied
==================
tvtime can not acces /dev/rtc and /dev/video0 :
[stein@localhost stein]$ tvtime
Running tvtime 0.9.12.
rtctimer: Cannot open /dev/rtc: Permission denied
rtctimer: Cannot open /dev/misc/rtc: No such file or directory
Enhanced Real Time Clock support in your kernel is necessary for
smooth video. We strongly recommend that you load the 'rtc' kernel
module before starting tvtime, and make sure that your user has
access to the device file (/dev/rtc or /dev/misc/rtc). See our
support page at http://tvtime.net/ for more information.
Reading configuration from /etc/tvtime/tvtime.xml
Reading configuration from /home/stein/.tvtime/tvtime.xml
videoinput: Cannot open capture device /dev/video0: Permission denied
Thank you for using tvtime.
[stein@localhost stein]$ rpm -q tvtime
tvtime-0.9.12-5
==================
Regards,
David
----------------------------------------------------------------------------
-----------
http://noepatents.org/ Innovation, not litigation !
---
David Balazic mailto:david.balazic@xxxxxxxxx
HERMES Softlab http://www.hermes-softlab.com
Zagrebska cesta 104 Phone: +386 2 450 8851
SI-2000 Maribor
Slovenija
----------------------------------------------------------------------------
-----------
"Be excellent to each other." -
Bill S. Preston, Esq. & "Ted" Theodore Logan
----------------------------------------------------------------------------
-----------
