hi all,
in fc7 rawhide, with target policy 2.5.9-2, will prevent mono
from doing something.
avc: denied { write } for comm="beagled" cwd="/home/yangshao" dev=00:03
egid=500 euid=500 exe="/usr/bin/mono" exit=-13 fsgid=500 fsuid=500
gid=500 inode=55866 item=0 items=1 mode=0100644 name="make-it-fail"
obj=user_u:system_r:unconfined_t:s0 ogid=500 ouid=500
path="/proc/3185/make-it-fail" pid=3091 rdev=00:00
scontext=user_u:system_r:mono_t:s0 sgid=500
subj=user_u:system_r:mono_t:s0 suid=500 tclass=file
tcontext=user_u:system_r:unconfined_t:s0 tty=(none) uid=500
avc: denied { write } for comm="beagled" cwd="/home/yangshao" dev=00:03
egid=500 euid=500 exe="/usr/bin/mono" exit=-13 fsgid=500 fsuid=500
gid=500 inode=55852 item=0 items=1 mode=0100600 name="mem"
obj=user_u:system_r:unconfined_t:s0 ogid=500 ouid=500
path="/proc/3185/mem" pid=3091 rdev=00:00
scontext=user_u:system_r:mono_t:s0 sgid=500
subj=user_u:system_r:mono_t:s0 suid=500 tclass=file
tcontext=user_u:system_r:unconfined_t:s0 tty=(none) uid=500
avc: denied { write } for comm="beagled" cwd="/home/yangshao" dev=00:03
egid=500 euid=500 exe="/usr/bin/mono" exit=-13 fsgid=500 fsuid=500
gid=500 inode=55864 item=0 items=1 mode=0100644 name="oom_adj"
obj=user_u:system_r:unconfined_t:s0 ogid=500 ouid=500
path="/proc/3185/oom_adj" pid=3091 rdev=00:00
scontext=user_u:system_r:mono_t:s0 sgid=500
subj=user_u:system_r:mono_t:s0 suid=500 tclass=file
tcontext=user_u:system_r:unconfined_t:s0 tty=(none) uid=500
avc: denied { write } for comm="beagled" cwd="/home/yangshao" dev=00:03
egid=500 euid=500 exe="/usr/bin/mono" exit=-13 fsgid=500 fsuid=500
gid=500 inode=55865 item=0 items=1 mode=0100644 name="loginuid"
obj=user_u:system_r:unconfined_t:s0 ogid=500 ouid=500
path="/proc/3185/loginuid" pid=3091 rdev=00:00
scontext=user_u:system_r:mono_t:s0 sgid=500
subj=user_u:system_r:mono_t:s0 suid=500 tclass=file
tcontext=user_u:system_r:unconfined_t:s0 tty=(none) uid=500
avc: denied { setattr } for comm="beagled" cwd="/home/yangshao"
dev=00:03 egid=500 euid=500 exe="/usr/bin/mono" exit=-13 fsgid=500
fsuid=500 gid=500 inode=160224 item=0 items=1 mode=0100644
name="oom_adj" obj=user_u:system_r:unconfined_t:s0 ogid=500 ouid=500
path="/proc/3117/oom_adj" pid=3091 rdev=00:00
scontext=user_u:system_r:mono_t:s0 sgid=500
subj=user_u:system_r:mono_t:s0 suid=500 tclass=file
tcontext=user_u:system_r:unconfined_t:s0 tty=(none) uid=500
......
as i know, this problem happens from target policy 2.5.8-8.
i wrote a loadable module, after installing, such problems had not
happened again until now.
there is only a ".te" file in this module:
"
module mymono 1.0;
require {
type unconfined_t;
type mono_t;
class file { write setattr };
}
#============= mono_t ==============
allow mono_t unconfined_t:file { write setattr };
"
can anyone can guide me if the '.te' file has something wrong.
i know, in reference policy, we should use interface, but i am
a newbie for selinux policy, i don't know how to begin writing
policy using interface?
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
