-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Paul Howarth wrote:
> Got a bunch of AVCs whilst installing these updates today:
>
> Nov 22 07:50:15 Updated: bind-libs - 32:9.5.0-18.a7.fc8.x86_64
> Nov 22 07:50:17 Updated: pilot-link - 2:0.12.2-7.fc8.x86_64
> Nov 22 07:50:20 Updated: bind - 32:9.5.0-18.a7.fc8.x86_64
> Nov 22 07:50:22 Updated: smolt - 1.0-1.fc8.noarch
> Nov 22 07:50:25 Updated: system-config-firewall-tui - 1.0.11-1.fc8.noarch
> Nov 22 07:50:25 Updated: bind-utils - 32:9.5.0-18.a7.fc8.x86_64
> Nov 22 07:50:29 Updated: system-config-firewall - 1.0.11-1.fc8.noarch
> Nov 22 07:50:29 Updated: smolt-firstboot - 1.0-1.fc8.noarch
> Nov 22 07:50:35 Updated: bind-chroot - 32:9.5.0-18.a7.fc8.x86_64
> Nov 22 07:50:37 Updated: setroubleshoot-plugins - 1.10.4-1.fc8.noarch
> Nov 22 07:50:38 Updated: libao - 0.8.8-2.fc8.x86_64
> Nov 22 07:50:40 Updated: pilot-link - 2:0.12.2-7.fc8.i386
>
>
> Piping the AVCs into audit2allow -R yielded:
>
> require {
> type named_conf_t;
> type setfiles_t;
> type proc_t;
> class lnk_file relabelfrom;
> class dir relabelfrom;
> class file relabelfrom;
> class filesystem associate;
> }
>
> #============= named_conf_t ==============
> allow named_conf_t proc_t:filesystem associate;
>
> #============= setfiles_t ==============
> allow setfiles_t self:dir relabelfrom;
> allow setfiles_t self:file relabelfrom;
> allow setfiles_t self:lnk_file relabelfrom;
> kernel_getattr_core_if(setfiles_t)
> kernel_getattr_message_if(setfiles_t)
> kernel_read_device_sysctls(setfiles_t)
> kernel_read_kernel_sysctls(setfiles_t)
> kernel_read_net_sysctls(setfiles_t)
> kernel_read_software_raid_state(setfiles_t)
> kernel_read_vm_sysctls(setfiles_t)
>
> As far as I can see, the updates installed OK.
>
> I can post the raw audit messages if it's useful.
>
> Paul.
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Most of these are caused by bind-chroot running a recursive restorecon
over the /var/chroot directory after /proc is mounted. The restorecon
command runs over all the directories and tries to relabel them
named_conf_t including the /proc mounted under the chroot. bind-chroot
should run the restorecon before mounting the file systems, which would
eliminate these avc's. I have updated the bugzilla.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iD8DBQFHVCKmrlYvE4MpobMRAgzsAJsFX/TJCHznz3XTynhpG60tjspAfACeN8oL
OmS/X49YK/J9gNzvZTfFUHI=
=yetv
-----END PGP SIGNATURE-----
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
