On Mon, 2 Aug 2004 07:00, Tom London <selinux@xxxxxxxxxxx> wrote:
> I noticed what I think are new avcs coming from starting cups:
>
> Aug 1 13:49:59 fedora kernel: audit(1091393399.153:0): avc: denied {
> write }
> for pid=2117 exe=/usr/bin/python name=util dev=hda2 ino=4309019
> scontext=system_u:system_r:cupsd_t tcontext=system_u:object_r:usr_t
> tclass=dir
>
> ino#4309019 is /usr/share/printconf/util
> (not sure why cups wants to write there ....)
What is under that directory tree?
What does cups do in this situation if you put the machine in permissive mode
and do the same print operation?
Naturally we can't give cups access to usr_t. We could use a different label
for the directory in question as an interim measure. But I think that this
is really a bug in cups. I don't think that there's any good reason for cups
to be writing there. I think that systems with a /usr file system mounted
read-only should work fine as print servers!
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
