Appears a bit more complicated.....
Even after adding all the above, sound is still disabled.
Here is the AVC:
type=AVC msg=audit(1201376293.488:17): avc: denied { ptrace } for
pid=2471 comm="console-kit-dae"
scontext=system_u:system_r:system_dbusd_t:s0
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process
type=SYSCALL msg=audit(1201376293.488:17): arch=40000003 syscall=3
success=no exit=-3 a0=e a1=bfa13948 a2=1000 a3=0 items=0 ppid=1
pid=2471 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="console-kit-dae"
exe="/usr/sbin/console-kit-daemon"
subj=system_u:system_r:system_dbusd_t:s0 key=(null)
I tried removing the above rule, setting "allow_ptrace=1" and
reinserting the allow rule, but no joy. Still get this AVC and no
sound.
Also, the new "shutdown" menu item generates lots of AVCs:
#============= system_dbusd_t ==============
allow system_dbusd_t init_exec_t:file { read execute execute_no_trans };
allow system_dbusd_t initctl_t:fifo_file write;
allow system_dbusd_t initrc_var_run_t:file { read write lock };
allow system_dbusd_t lib_t:file execute_no_trans;
allow system_dbusd_t polkit_auth_exec_t:file { read execute execute_no_trans };
allow system_dbusd_t polkit_var_lib_t:dir search;
allow system_dbusd_t polkit_var_lib_t:file { read getattr };
allow system_dbusd_t polkit_var_run_t:dir search;
allow system_dbusd_t shell_exec_t:file { read execute };
allow system_dbusd_t tty_device_t:chr_file { write getattr };
After adding these, still doesn't work.
Will try "semodule -DB"......
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
