Running targeted/enforcing, latest rawhide.
I get this:
----
type=PATH msg=audit(03/07/2006 09:11:05.866:13) : item=0
name=/proc/sys/vm/ flags=follow,access inode=4026531930 dev=00:03
mode=dir,555 ouid=root ogid=root rdev=00:00
type=CWD msg=audit(03/07/2006 09:11:05.866:13) : cwd=/usr/share/hal/scripts
type=SYSCALL msg=audit(03/07/2006 09:11:05.866:13) : arch=i386
syscall=access success=no exit=-13(Permission denied) a0=95213b8 a1=2
a2=2 a3=9520528 items=1 pid=2674 auid=unknown(4294967295) uid=root
gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
comm=pm-powersave exe=/bin/bash
type=AVC msg=audit(03/07/2006 09:11:05.866:13) : avc: denied { write
} for pid=2674 comm=pm-powersave name=vm dev=proc ino=-268435366
scontext=system_u:system_r:hald_t:s0
tcontext=system_u:object_r:sysctl_vm_t:s0 tclass=dir
----
I think it comes from /usr/sbin/pm-powersave:
if [ ! -w "/proc/sys/vm/" ] ; then
# Use the raw kernel sysfs interface
echo "You do not have write access to /proc/sys/vm/"
exit 1
fi
/proc/sys/vm appers to not want to be written:
[tbl@localhost vm]$ ls -ldZ /proc/sys/vm
dr-xr-xr-x root root system_u:object_r:sysctl_vm_t /proc/sys/vm
[tbl@localhost vm]$
Should this be a 'dontaudit'? E.g.:
dontaudit hald_t sysctl_vm_t:dir write;
tom
--
Tom London
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
