On Sat, 2004-07-10 at 03:23, Richard Hally wrote:
> When booting in enforcing mode with the latest strict
> policy(selinux-policy-strict-sources-1.14.1-5)
> the following avc denied message is produced.
>
> Jul 10 03:12:02 new2 network: Bringing up interface eth0: succeeded
> Jul 10 03:12:04 new2 kernel: audit(1089443524.677:0): avc: denied {
> name_bind
> } for pid=2016 exe=/usr/bin/mDNSResponder scontext=user_u:user_r:user_t
> tcontext=system_u:object_r:dns_port_t tclass=udp_socket
The fact that it is running in user_u likely means that it is being
started via su (to run in some pseudo user identity), and since that
pseudo user identity does not exist in the policy, it is being remapped
to user_u.
--
Stephen Smalley <sds@xxxxxxxxxxxxxx>
National Security Agency
