On Wed, 2006-09-27 at 13:32 -0400, Richard Irving wrote:
> Hi,
> I am having two issues with FC5 (x86_64) and selinux....
>
> First, it appears the system is having a problem logging AVC's:
>
> ===================================================================
> Sep 27 13:09:16 localhost dbus: Can't send to audit system: USER_AVC
> avc: received policyload notice (seqno=4) : exe="?" (sauid=81,
> hostname=?, addr=?, terminal=?)
> Sep 27 13:09:16 localhost dbus: Can't send to audit system: USER_AVC
> avc: 2 AV entries and 2/512 buckets used, longest chain length 1 :
> exe="?" (sauid=81, hostname=?, addr=?, terminal=?)
> Sep 27 13:09:16 localhost dbus: Can't send to audit system: USER_AVC
> avc: received policyload notice (seqno=4) : exe="/bin/dbus-daemon"
> (sauid=500, hostname=?, addr=?, terminal=?)
> Sep 27 13:09:16 localhost dbus: Can't send to audit system: USER_AVC
> avc: 0 AV entries and 0/512 buckets used, longest chain length 0 :
> exe="/bin/dbus-daemon" (sauid=500, hostname=?, addr=?, terminal=?)
Not certain about this one, although I recall issues with the session
dbus (which runs with the user's identity, not as root) not being able
to generate audit messages in the past. Steve?
> ================================================================
>
> And second, I was working on a hand edited local.te, as selinux is
> preventing vsftpd from creating files in users home directories...
> When running the policy compiler, I get.....
>
> ========================================================================
> (unknown source)::ERROR 'permission write is not defined for class dir'
> at token ';' on line 22:
> allow ftpd_t user_home_dir_t:dir { getattr read search write };
> allow ftpd_t user_home_t:dir { getattr read search write };
> ===============================================================
>
> And it appears "write" is no longer a valid attribute for directories
> ? What is its replacement ? The AVC is calling it a "write" problem...
> and audit2allow says the correcting line should be:
>
> allow ftpd_t user_home_dir_t:dir write;
>
> Am I missing something ?
>
> TIA!
How was that local.te file generated? In any event, assuming you are
trying to build it as a module, it needs to declare any required
permissions in its require block, which can either be done explicitly or
by using the policy_module() macro. Otherwise, the compiler doesn't
know that it is an external dependency.
--
Stephen Smalley
National Security Agency
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
